You chose the correct answer.
Under the FCRA, the end-user is responsible for complying
with the adverse action requirments if it will be taking
adverse action against a consumer based in whole or in part
on the consumer report. If a CRA contracts with an end-user
to provide this service, the CRA should follow the process
required under the FCRA. When an applicant for employment
(or an employee being screened during employment) will be
subject to adverse action, the FCRA requires that the applicant
or employee be notified that the company may take adverse
employment action and given a copy of their consumer report
along with a copy of the FTC's Summary of Rights. 15 U.S.C.
1681 b(b)(3). This notification must inform the employee
or applicant of his or her right to dispute the information
in the report. The FCRA then requires that the employer
wait a "reasonable" amount of time and then inform
the employee or applicant that the adverse action decision
has been made. The FTC has opined that a resonable amount
of time is five days.