How to Run a Credit Check on a Tenant: FCRA Rules

The sign-up page wants your name, the address of the unit, and a checkbox. Behind that checkbox you certify, to a company you have never spoken to, that you have a permissible purpose under federal law and that you will use what arrives for nothing else.

That certification is the regulated act. Not reading the report, not the decision you reach from it — the obtaining. An owner who pulls a file on the wrong person has already broken the rule before anybody has been denied anything, and the statute puts a floor under that moment: a natural person who obtains a consumer report knowingly without a permissible purpose owes the consumer actual damages or $1,000, whichever is greater, plus costs and reasonable attorney's fees, and can owe the reporting agency another $1,000 separately.

Everything below was read on 2 October 2026. The Fair Credit Reporting Act comes from Cornell's Legal Information Institute, the disposal rule from the eCFR versioner API, the withdrawal and preemption notices from the Federal Register's own full-text endpoint, California's code from leginfo, and New York City's rules from the Commission on Human Rights' published notice. I am not a lawyer and none of this is legal advice. It is the mechanism plus the section numbers, and the rule that actually governs your unit may turn out to be a city ordinance rather than anything federal.

Permissible purpose is a sentence in a statute, not a setting in an app

15 U.S.C. § 1681b lists every circumstance in which a consumer reporting agency may hand a report to anybody at all. Two of them reach a landlord.

The first is the consumer's own instruction. Subsection (a)(2) permits furnishing a report "in accordance with the written instructions of the consumer to whom it relates." The second is the general business provision in (a)(3)(F), which reaches a person who "otherwise has a legitimate business need for the information — (i) in connection with a business transaction that is initiated by the consumer."

Read that slowly, because the working words are initiated by the consumer. The transaction has to have been started by the person whose file you are about to open. The FTC's Using Consumer Reports: What Landlords Need to Know, last updated July 2023, puts the two qualifying situations plainly: "Landlords may get consumer reports on applicants and tenants who apply to rent housing or renew a lease." Applying. Renewing. Both are things the other person does.

Which tells you where the line falls in the cases that actually come up. The adult who moved in with your tenant in March and never filled anything out has initiated nothing. Neither has the person who emailed three questions about the unit and never applied. Neither has the sitting tenant you have started to worry about in month seven of a twelve-month term — until a renewal is on the table, there is no transaction they started. Curiosity is not a business need, and the statute does not soften for a landlord with two houses.

Subsection (f) then closes the loop from your side rather than the agency's: "A person shall not use or obtain a consumer report for any purpose unless— (1) the consumer report is obtained for a purpose for which the consumer report is authorized to be furnished under this section; and (2) the purpose is certified in accordance with section 1681e of this title by a prospective user of the report through a general or specific certification."

Two conditions, both yours. An application the other person completed, and a certification you made.

The amounts the statute names, and the exemption that does not exist

Most screening advice treats the FCRA as paperwork. The liability sections read differently.

Section 1681n covers willful noncompliance. Subsection (a)(1)(A) allows the consumer "any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000" — a floor that does not require proving harm. Subsection (a)(1)(B) raises it for the specific case this page is about: for a natural person who obtains a report "under false pretenses or knowingly without a permissible purpose," actual damages or $1,000, whichever is greater. Then (a)(2) adds "such amount of punitive damages as the court may allow," and (a)(3) adds costs and reasonable attorney's fees for a successful action. Subsection (b) runs the other direction: obtain a report under false pretenses or knowingly without a permissible purpose and you are liable to the reporting agency too, for its actual damages or $1,000, whichever is greater.

Section 1681q is one sentence and it is criminal: "Any person who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses shall be fined under title 18, imprisoned for not more than 2 years, or both."

Nothing in any of that scales with the number of units you own. There is no two-unit exception, no owner-occupied exception, no first-offence allowance. The thresholds in the Act turn on the size of the credit transaction, not the size of the landlord — § 1681c(b) lifts the reporting time limits for credit transactions of $150,000 or more and employment paying $75,000 or more, and a residential lease is on neither list.

Why the bureaus will not simply sell you one

Owners regularly discover that they cannot open an account with Experian the way they open one with a hardware supplier, and assume somebody is gatekeeping for commercial reasons. The gate is statutory.

Section 1681e(a) requires every agency to maintain reasonable procedures to limit furnishing to the permitted purposes, and spells out what those procedures must include: "prospective users of the information identify themselves, certify the purposes for which the information is sought, and certify that the information will be used for no other purpose." Then the sentence that creates the friction: "Every consumer reporting agency shall make a reasonable effort to verify the identity of a new prospective user and the uses certified by such prospective user prior to furnishing such user a consumer report." And a prohibition on furnishing at all where the agency "has reasonable grounds for believing that the consumer report will not be used for a purpose listed in section 1681b."

The industry's answer to "reasonable effort to verify the identity of a new prospective user" is an inspection. The National Tenant Network, a screening company, describes the practice this way: real estate owners, investors and managers who want to keep receiving applicants' credit reports "must undergo an on-site inspection," and "Experian, TransUnion and Equifax all require an independent inspection company, approved by the bureau, to conduct the inspection." For a subscriber working from a home office, it says, "the inspection may be required annually." That is a vendor describing its own market rather than a statute, but it explains the thing that puzzles small owners: somebody wants to look at the room where the reports would be stored, and for a two-unit landlord that room is a spare bedroom.

Which is why nearly every route open to a one-to-four-unit owner runs through the applicant instead. TransUnion's SmartMove, to name the most visible, describes a flow where the applicant receives an email invitation, consents, and verifies their own identity: "As soon as authorization is received and their identity is verified, reports are delivered to your inbox." Its published tiers on 2 October 2026 were $25 for a score and criminal search, $40 adding credit and eviction records, and $49 for the fullest package, each plus tax. Other services are built the same way and the names change faster than the mechanism.

The trade is worth understanding rather than just accepting. You never handle the applicant's Social Security number, which removes your largest single data risk. You also never see the raw file the bureau holds — you see the package the reseller assembled. And whether you may pass that $25 to $49 along to the applicant at all is a question of state law, not of what the vendor charges, which belongs with the written criteria you set before the listing went up.

Six different things are consumer reports, and one of them is a number somebody computed

The FTC's landlord page lists what counts, and the list is wider than most owners picture. Credit reports from the three bureaus. Tenant screening reports covering rental and eviction history. Criminal background reports. Combined products stitching all three together. Risk scores and recommendations produced by screening companies. And reports from a reference-checking service that calls previous landlords or employers on your behalf.

The fifth entry is the one that catches people. A ResidentScore, a traffic-light recommendation, an "approve with conditions" verdict — those are consumer reports in their own right. So "the system flagged them" is not a different kind of decision from "the credit file showed X." If that number contributed to a denial, or to approving somebody on tougher terms than another applicant would have faced, the adverse action duty attaches exactly as it would otherwise, and the notice obligations and what counts as adverse action sit alongside the income side of the file.

The sixth entry matters for a different reason: it means outsourcing phone calls converts your own reference check into a regulated report. Make the calls yourself and you are not generating a consumer report. Hire somebody to make them and you are.

What federal law deletes from the report, and the one line it leaves in

Section 1681c(a) is the obsolescence rule, and it is a short list worth knowing by heart because it tells you what a clean-looking report has quietly dropped.

Bankruptcies drop out more than ten years after the order for relief. Civil suits, civil judgments and records of arrest drop out after "more than seven years or until the governing statute of limitations has expired, whichever is the longer period." Paid tax liens, seven years from payment. Accounts placed for collection or charged to profit and loss, seven years. Then the sweep clause, which is where the surprise lives: "Any other adverse item of information, other than records of convictions of crimes which antedates the report by more than seven years."

Convictions are the carve-out. Federally, a conviction has no expiry on a consumer report at all.

The eviction line is the one that changes how you read what you bought. An eviction judgment is a civil judgment, so the federal ceiling is seven years or the limitations period, whichever is longer — and a case that was filed and then settled or dismissed is not a judgment at all. Plenty of records that show up as "eviction history" in a screening package are filings rather than outcomes, which is a meaningful difference once you know how many separate stages an eviction actually has and how many end before judgment.

Accuracy is the agency's problem, not yours. Section 1681e(b) requires an agency preparing a report to "follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates." Your exposure is narrower and more practical: a common name plus a name-only match produces somebody else's record in your folder, and you are the one about to act on it. If a report shows something the applicant denies flatly and specifically, the cheap move is to ask the agency to confirm the identifiers before you decide anything.

One thing to know about the guidance under all of this. The CFPB withdrew a long list of its own interpretations, applicable 12 May 2025, published at 90 FR 20084. Three of them were written for exactly this situation: the advisory opinion on Fair Credit Reporting; Background Screening at 89 FR 4171, the one on Permissible Purposes for Furnishing, Using, and Obtaining Consumer Reports at 87 FR 41243, and the one on Name-Only Matching Procedures at 86 FR 62468. Articles that quote them as current are quoting documents the Bureau has pulled. The statute those opinions interpreted was not amended, so the sections above still read the way they read.

Your state deletes different things, and an October 2025 interpretive rule aims at that

Federal obsolescence is a floor, and several states built above it.

California is the clearest example, because it does two things at once. Civil Code § 1785.13(a) bars a consumer credit reporting agency from including "unlawful detainer actions, unless the lessor was the prevailing party" — a case the landlord filed and did not win is gone, regardless of age. The statute then defines prevailing party, and the definition is worth reading before you settle anything: the lessor qualifies only on a final judgment entered on the tenant's default, on summary judgment or after trial, or where "the action was resolved by a written settlement agreement between the parties that states that the unlawful detainer action may be reported." Settle on any other terms and the case is unreportable in California no matter who paid whom.

And paragraph (a)(6) bars "records of arrest, indictment, information, misdemeanor complaint, or conviction of a crime that, from the date of disposition, release, or parole, antedate the report by more than seven years." That is the federal conviction carve-out closed shut. The same applicant, screened on the same day by the same company, produces a visibly different document in California than in a state with no such statute.

That difference is now contested ground. I pulled the full text of the CFPB's interpretive rule published 28 October 2025, 90 FR 48710, and its position is that the FCRA "generally preempts State laws that touch on broad areas of credit reporting." Working through 15 U.S.C. § 1681t(b)(1)(E), which bars state requirements "with respect to any subject matter regulated under" § 1681c "relating to information contained in consumer reports," the Bureau reads the subject matter as the whole question of what goes into a report: "that subject matter is broad — it covers the inclusion of information in consumer reports. All State laws on that subject are preempted." The rule it replaces, from July 2022 and withdrawn in May 2025, had read the same clause narrowly and had specifically named rental information and arrest records as areas where states could still legislate.

Two cautions before anyone acts on that. An interpretive rule is an agency's reading of a statute, not a court's holding, and preemption fights are settled in courts. More to the point for a landlord: the clause in question is about what an agency may put in a report. It is a different question from what you may consider, what your city requires you to do before you look, or whether you owe a written notice afterwards — and those duties sit in fair housing law, local ordinances and other parts of the FCRA, which this rule does not touch. The practical reading for a two-unit owner is that the report you receive may change, and your own obligations probably will not.

New York City moved the background check to after the offer

The sharpest ordinance in the country on this is the NYC Fair Chance Housing Law, effective 1 January 2025, and it reorders the whole sequence rather than adjusting a threshold.

Under the Commission on Human Rights' published notice, a covered provider "must first consider your general housing eligibility (ability to meet lease terms) AND make a conditional offer of housing. Only after this conditional offer is it lawful for a covered housing provider to run a criminal background check." Before running one, the provider has to make that written conditional offer and hand over a copy of the notice itself. Seeking conviction history earlier is the violation — and so is mentioning criminal background checks in the ad or on the application.

What may then be weighed is narrow: convictions requiring sex offender registration at the time of the check, felony convictions from the last five years, and misdemeanor convictions from the last three. The notice is specific about the clock: "The 3 or 5 years are measured from the actual date of release OR the sentencing date (if the sentence does not include jail or prison time), regardless of probation or parole status." Never considerable at all are arrests, pending cases, sealed or vacated convictions, violations such as disorderly conduct, adjournments in contemplation of dismissal, and youthful offender adjudications.

If the provider wants to pull the offer back, the process continues rather than ends. The applicant gets copies of everything received or reviewed and five business days to respond, an individualized assessment has to happen whether or not they respond, and a revocation requires a written statement showing a specific and objective legitimate business interest and its link to that individual's history. The notice then lists seven sentences that do not qualify, and they are worth reading because they are the sentences owners actually think — among them "My insurance rates will go up," "This is a family building," and "My tenants don't want criminals."

Then the line that matters most to this site's reader, in the exemptions section: "Housing provider-occupied properties with 2 or fewer rooms or units are not covered by the NYC Fair Chance Housing Law." An owner living in half a Brooklyn two-family is outside it. The same owner with a three-unit building they live in is inside it. One unit decides which set of rules runs your application, which is a good argument for checking the ordinance for your own city before you assume anything about your own size.

The record you keep is regulated too, and this is the part nobody sets up

A report arrives as a PDF. It goes into email, then onto a laptop, then — if the applicant was approved — into a folder beside the signed lease, where it sits for years.

The FTC's disposal rule covers that folder. I pulled Part 682 from the eCFR versioner API, which gives Title 16 a latest issue date of 24 September 2026 and shows it current through 30 September 2026, and the scope clause at § 682.2(b) is deliberately wide: the rule "applies to any person over which the Federal Trade Commission has jurisdiction, that, for a business purpose, maintains or otherwise possesses consumer information." Section 682.1(b) defines consumer information as "any record about an individual, whether in paper, electronic, or other form, that is a consumer report or is derived from a consumer report," which takes in the notes you typed out of the report as well as the report.

The standard in § 682.3(a) is one sentence: anyone holding consumer information for a business purpose "must properly dispose of such information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal." The examples that follow name burning, pulverizing or shredding paper, and destroying or erasing electronic media, so that the information "cannot practicably be read or reconstructed."

For one or two units that turns into three habits rather than a policy. Keep screening reports somewhere other than your email inbox, because an inbox is a filing cabinet nobody ever empties. Write on your criteria page how long you keep reports for applicants you declined, and then actually delete them on that schedule. And when you replace the laptop, erase the old drive rather than donating the folder with it.

Where a two-unit owner is actually exposed

The denial is the part that feels risky and it is the part with the clearest instructions: a notice, a named agency, a right to dispute. The two steps with no instructions attached are the ones before and after.

Before: a report pulled on somebody who never applied, which is a completed violation with a $1,000 floor and no denial required. After: a file full of somebody's Social Security number and credit history sitting in an inbox for six years.

So the useful additions to the criteria page are short, and they are about your conduct rather than the applicant's. We obtain reports only on people who have submitted a completed application or a renewal. We keep the applicant's signed authorization with the report. We destroy reports for applicants we did not house within a stated number of days, and we delete rather than archive. None of that improves an applicant's chances or makes a decision easier. It means that if anybody ever asks why you had somebody's credit file, the answer is a date and a document instead of a recollection.