Meet Michael Jones.
Michael wants a job as a youth minister, a high school basketball coach, or a janitor at a daycare. If you're his potential employer, you already know you need a background check. The safety of the children in your building isn't negotiable.
But here's the thing - Michael Jones isn't hiding anything from you.
Michael Jones is a common name. And every single person who shares it has legal protections that could land you in court if your screening process cuts corners.
The question isn't whether to screen Michael. It's whether your background check provider is doing it right - or just matching names and calling it a day.
So, who makes these rules – and what, specifically, are they? For that matter, does your background check company know what the rules are and how they keep changing?
You’ve probably heard of the Federal Trade Commission (FTC), and maybe you already know that the FTC is a rule-maker in this area. But did you know that the Consumer Financial Protection Bureau (CFPB) also has an important role to play?
That’s right. The same agency that protects consumers from unscrupulous lenders also has a say about what’s fair when potential employers perform background checks.
That’s because background screeners are considered to be consumer reporting agencies (CRA) – just like Equifax, TransUnion, and Experian. In other words, ignoring CFPB guidance could mean trouble under the Fair Credit Reporting Act (FCRA).
Meanwhile, Michael Jones is waiting. As a job applicant, what rights does he have?
When we first published this article in 2022, we pointed to the CFPB's November 2021 advisory opinion that declared name-only matching illegal under the Fair Credit Reporting Act. That guidance was a wake-up call for the industry: matching a consumer's records based solely on first and last name - without verifying through additional identifiers like date of birth, Social Security number, or address - doesn't meet the FCRA's standard for "maximum possible accuracy."
Then the CFPB doubled down.
In January 2024, the Bureau issued two additional advisory opinions targeting background screening practices. These went further, clarifying that consumer reporting agencies must have procedures to prevent reporting duplicative information, must include disposition data when reporting arrests or charges, and cannot report records that have been expunged or sealed.
The message was clear: sloppy screening practices weren't just bad business - they were violations of federal law. Then came the plot twist.
In May 2025, the CFPB - under new leadership - withdrew 67 guidance documents, including the 2021 name-only matching advisory opinion and the January 2024 background screening guidance.
The rationale? Reducing regulatory burden and returning to formal rulemaking rather than enforcement through informal guidance.
Here's what too many employers (and some screening providers) got wrong about that withdrawal: it didn't change the law. The FCRA's requirement for maximum possible accuracy remains statutory. Federal courts have consistently held that name-only matching fails that standard. And state regulators, especially in states like New York and California, have shown every indication of stepping into whatever enforcement void the federal government leaves behind.
If your background check company is treating the CFPB withdrawal as a green light to return to sloppy matching, that's not deregulation working in your favor. That's a lawsuit waiting to happen.
FCRA class-action settlements continue to climb. A $5 million settlement against J.B. Hunt in 2025. A $2.4 million PeopleFacts settlement. A $23 million TransUnion resolution. Barnes & Noble paid $600,000 because a single footnote in their disclosure form wasn't supposed to be there.
These aren't isolated incidents. They're a pattern - and the targets aren't just background screening companies. Employers who use the reports face the same exposure. The average FCRA settlement now exceeds $2.2 million, and plaintiffs' attorneys have gotten very, very good at finding technical violations that affect entire applicant classes.
Since we first wrote this article, New York has enacted two major changes that make accurate identity matching even more critical for employers operating in the state.
The Clean Slate Act, effective November 16, 2024, provides for the sealing of eligible misdemeanor convictions after three years and felony convictions after eight years. The state's Unified Court System has until November 2027 to fully implement the sealing process. Once a record is sealed, it won't appear on most background checks, and employers are prohibited from inquiring about or acting on sealed convictions.
What does this mean for name-only matching? Everything.
If your screening provider is still running loose name matches, they could be pulling sealed records that shouldn't be in the report at all - or worse, attributing someone else's unsealed record to your applicant. Either scenario puts you on the wrong side of both the Clean Slate Act and the FCRA.
The Act also imposes heightened notice obligations. Every time you receive criminal history information on an applicant, you must provide them with a copy of that information along with a copy of Article 23-A of the New York Correction Law. Every. Single. Time. Not just when you're considering adverse action.
And Article 23-A itself hasn't gone anywhere. Employers are still prohibited from unfairly discriminating against individuals with prior convictions, and the seven-factor test for evaluating criminal history in hiring decisions remains fully in force. The EEOC's guidance reinforcing individualized assessments continues to apply as well—blanket disqualification policies based on criminal history aren't just risky, they're indefensible.
Here's the uncomfortable reality: the regulatory environment for background screening is getting more complex, not less. The CFPB may have pulled back its guidance, but the FCRA is still the FCRA. State laws like Clean Slate are adding new layers of obligation. AI and automated screening tools are introducing new compliance questions about transparency and human oversight. And plaintiffs' attorneys are filing cases at a record pace.
In this environment, relying on a screening provider that matches names and moves on isn't just outdated - it's reckless.
CIChecked is a New York State-licensed private investigative agency and consumer reporting agency. That distinction matters more than most employers realize.
As licensed investigators, we access data sets that aren't available to database-only screening companies. We don't match names and hope for the best. We verify identity through multiple factors - date of birth, Social Security number, physical addresses - and apply human intervention at every stage of the process.
Our proprietary NY Checked™ search was built specifically to address the limitations of New York's criminal record system. At $32.50 per search (compared to $95 through the Office of Court Administration), with results typically delivered in 2–4 hours, it provides comprehensive coverage, including name variations, fuzzy matching, and arrest, conviction, and pending information. It's not a replacement for the OCA - it's a complement that fills the gaps most providers don't even know exist.
When adverse information does appear, we don't leave you guessing about next steps. Our Individualized Assessment Decision Matrix™ (IADM) guides you through a structured evaluation process that aligns with Article 23-A's seven-factor test and EEOC guidance - creating the kind of documented, defensible hiring decisions that hold up to scrutiny.
We pick up the phone on the first ring 98% of the time and resolve 88% of inquiries the same day. Because when you're making decisions about people's careers - and the safety of the people in your building - you deserve a partner who takes that as seriously as you do.
The rules haven't gotten simpler since 2022. They've gotten harder. The CFPB's guidance withdrawal didn't eliminate your obligations - it just removed the guardrails that some providers were barely following in the first place.
If your background check provider is still relying on name-only matching, or if you're not sure how they're verifying identity, it's time for a conversation. Not with them. With us.
Schedule a 15-minute assessment with our team