Property Manager FCRA Policy Example for Tenant Screening

When a property manager uses a third-party tenant screening report, the Fair Credit Reporting Act (FCRA) shapes how that report may be obtained and used. A written policy gives leasing, compliance, and IT teams one controlled process for disclosures, authorizations, decisions, notices, and records.

This page provides a practical policy example for U.S. property managers. It is a working framework, not legal advice. State and local housing, consumer-reporting, and record-retention rules may add obligations, so the final policy should be reviewed by qualified legal counsel for the properties and jurisdictions involved.

Why a Written FCRA Policy Matters

Tenant screening can involve credit information, rental-payment history, eviction records, criminal-record information, and other consumer-report data. Informal steps are difficult to apply consistently, especially across multiple properties or teams. A documented policy tells staff what they may request, who may approve a decision, when a notice must be sent, and where evidence belongs.

For operational control, the policy should sit alongside the related screening procedure, approved forms, notice templates, and retention schedule. A central policy and procedure management system helps keep the current version available to the right people while preserving a clear record of updates and acknowledgements.

What the FCRA Requires in a Tenant-Screening Workflow

The FCRA applies when a property manager uses a consumer report for a housing decision. Before ordering a report, the organization should have a permissible purpose and follow its consumer-reporting agency’s certification process. Applicants should receive the required disclosure and provide authorization before a report is obtained.

If information in a consumer report contributes to a decision that is adverse to the applicant, the organization must provide the notices required by the FCRA. An adverse action can include denying an application or offering terms that are less favorable because of information in the report. The final notice must identify the consumer-reporting agency that supplied the report and explain that the agency did not make the decision. It must also inform the applicant of their right to obtain a free copy of the report and dispute incomplete or inaccurate information.

A pre-adverse action step is commonly used to give an applicant an opportunity to review and address information before a final decision. The FCRA’s adverse-action notice requirement and any applicable state or local requirements should be reviewed with counsel when setting the process and timing.

Property Manager FCRA Policy Example

Policy name: Tenant Screening and Consumer Report Use Policy

Purpose

This policy establishes the organization’s requirements for obtaining, using, storing, and disposing of consumer reports during rental applicant screening. Its purpose is to support lawful, consistent, and documented housing decisions.

Scope

This policy applies to employees, temporary staff, and authorized service providers involved in rental applications, tenant screening, leasing decisions, adverse-action communications, record management, or administration of the screening process for [CONFIRM: legal entity name and covered properties].

Policy statement

Consumer reports may be requested and used only for a legitimate rental-housing purpose and only by authorized personnel. Screening decisions must follow the organization’s approved written criteria and applicable federal, state, and local law. No employee may use a consumer report for a personal purpose or share report information outside the approved process.

Roles and responsibilities

The Compliance Owner maintains the policy, approved forms, and review schedule.
Leasing personnel collect required applicant materials, deliver approved notices, and record each workflow step.
Authorized decision-makers apply the approved screening criteria and document the basis for the decision.
IT or records-management personnel control access to screening records and support secure retention and disposal.
Managers ensure that staff complete required policy acknowledgements and training.

Permissible Purpose and Access Controls

The organization may request a consumer report only in connection with a rental application or another lawful housing transaction and only after the required steps in the approved workflow have been completed. Access must be limited to personnel whose role requires it.

The screening vendor, report type, user access, and permissible-purpose certification must be approved through [CONFIRM: internal approval process or system of record]. Staff must not download, email, print, or store consumer reports outside the approved repository unless the organization’s documented security procedure permits it.

Applicant Disclosure and Authorization

Before a consumer report is requested, the applicant must receive the organization’s current disclosure and provide authorization in the format required by applicable law and the screening provider. The team must retain evidence of the completed authorization with the application record.

The disclosure and authorization process must be separate from the screening decision. Changes to the wording, delivery method, or approved form require review by [CONFIRM: policy owner and legal reviewer].

Consistent Evaluation of Consumer Reports

Authorized decision-makers must use the organization’s approved rental-screening criteria. They must apply the same documented process to comparable applications and must not make decisions using prohibited or irrelevant factors.

When a report contains information that may affect the decision, the decision-maker must record the applicable criterion and preserve the evidence required by the organization’s procedure. Do not alter a report, remove material information, or make a decision before the record is complete.

Pre-Adverse Action and Final Adverse Action

When information in a consumer report may lead to a denial or less favorable rental terms, staff must pause the decision and follow the approved adverse-action workflow.

Send the organization’s approved pre-adverse action communication, including the required report and consumer-rights materials where applicable.
Allow the response period set by the organization after legal review and any applicable state or local requirements.
Review any information supplied by the applicant under the documented escalation process.
If the final decision remains adverse and is based in whole or in part on the consumer report, issue the approved final adverse action notice.
Record the notice date, delivery method, decision-maker, consumer-reporting agency, and related application record.

The final notice must include the consumer-reporting agency’s name, address, and telephone number; state that the agency did not make the decision and cannot explain why it was made; and notify the applicant of the right to obtain a free copy of the report and dispute its accuracy or completeness. Use current approved language rather than drafting a notice from memory.

Record Retention, Security, and Disposal

Screening records contain sensitive personal information. Store them only in the approved system with role-based access. Retain records according to the organization’s approved schedule and any applicable legal requirements. At the end of the retention period, dispose of records securely so that consumer information cannot be read or reconstructed.

The policy should identify:

The system of record for applications, authorizations, reports, notices, and decision notes.
The staff roles permitted to view or manage each record type.
The retention period for each record type, approved by [CONFIRM: legal counsel or records-management owner].
The process for secure disposal, access review, incident reporting, and vendor oversight.

Making the Policy Work Across Teams

A policy is useful only when the people who carry it out can find and follow it. Publish the policy with the related procedure and templates in the same controlled location. Assign it to the leasing, compliance, HR, and IT roles that need it, require acknowledgement, and record completion.

DocRead works within SharePoint and Microsoft 365 to help organizations distribute controlled policies, target the relevant audience, track acknowledgements, and maintain evidence of policy delivery. For new leasing staff, the same approach can support structured employee onboarding so key screening responsibilities are not left to informal handover.

Review the policy whenever the screening vendor, forms, criteria, systems, or applicable law change. A scheduled review should also confirm that the notice templates, access permissions, and training materials still match the live process.

Common Mistakes to Avoid

Assuming the screening vendor takes responsibility for every step in the housing decision.
Ordering a consumer report before the required disclosure and authorization are complete.
Letting different properties or leasing teams use different criteria without approval.
Treating a conditional approval or other less favorable term as outside the adverse-action process.
Keeping consumer reports in inboxes, shared drives, or local devices without approved controls.
Using outdated disclosure, authorization, or adverse-action templates.
Failing to document who made the decision and which approved criterion applied.

Frequently Asked Questions

Is a written FCRA policy required for property managers?

The FCRA does not prescribe one specific written policy for property managers. A written, controlled policy is still a practical way to make the required workflow consistent, train staff, and retain evidence of how the process is managed.

Can a property manager rely on a screening vendor to handle compliance?

A screening vendor can provide reports and support parts of the process, but the property manager or housing provider still needs its own documented controls for how reports are requested, evaluated, and used in decisions.

What should be included in an adverse action record?

Keep the decision record, the applicable approved criterion, the report source, copies or evidence of the notices sent, dates and delivery method, and any response or escalation record. Confirm the complete retention requirements for the relevant jurisdiction with legal counsel.

How can policy acknowledgements be tracked in Microsoft 365?

Use a controlled policy-management workflow that assigns the current policy to the relevant audience, records acknowledgements, and keeps an audit trail of delivery and completion. See DocRead for SharePoint and Microsoft 365 for the available approach.

Sources

About the Author

Ryan Malaluan, CAPM®, is an SEO & Content Strategist with over 8 years of experience in SEO, content strategy, and digital marketing. He holds a Bachelor of Arts in Literature and is a Certified Associate in Project Management (CAPM®). Throughout his career, Ryan has worked with brands including Spacer, Airtasker, Marlee (formerly Fingerprint for Success), VEED.IO, and ROSEMET LLC, as well as several digital marketing agencies, helping businesses strengthen their organic visibility through strategic, results-focused SEO and content.

Property Manager FCRA Policy Example: Tenant Screening Compliance Made Clear