Complying with California AB 506 and the CalVECHS Background Check Program

Re-Published October 2026 | Prepared for boards, executive directors, pastors, and program leaders of California youth serving nonprofits and houses of worship

Purpose and Scope

If your organization serves minors in California, two connected legal frameworks require your board’s attention. Assembly Bill 506, codified as Business and Professions Code Section 18975 and in effect since January 1, 2022, requires youth service organizations to train and screen the adults who work with children and to adopt specific child abuse prevention policies. The California Volunteer and Employee Criminal History Service (CalVECHS), a Department of Justice (DOJ) program operating under Penal Code Section 11105.3, is the channel through which those organizations obtain the fingerprint-based background check results AB 506 requires, and DOJ has stated that organizations fingerprinting under Section 11105.3 must be enrolled before January 1, 2027.

This advisory reflects the CalVECHS regulations that took effect on July 1, 2026, and Assembly Bill 2796, an urgency statute that took effect on September 18, 2026, and rewrote Penal Code Section 11105.3.^, It summarizes what the law requires, explains how the two frameworks fit together, and closes with recommendations and a checklist your organization can act on before the enrollment deadline. It is general guidance and not legal advice, and you should consult qualified California counsel about how these requirements apply to your programs.

Requirements of Business and Professions Code Section 18975

Covered Organizations

Section 18975 applies to a “youth service organization,” which the statute defines as “an organization that employs or utilizes the services of persons who, due to their relationship with the organization, are mandated reporters pursuant to paragraph (7) of subdivision (a) of Section 11165.7 of the Penal Code.” That paragraph identifies “an administrator or employee of a public or private youth center, youth recreation program, or youth organization.” Coverage therefore depends on whether an organization has administrators or employees serving in a youth center, youth recreation program, or youth organization, a definition that commonly reaches youth sports leagues, camps, scouting and mentoring programs, after school programs, and churches that employ staff in children’s or youth ministry. An organization that is unsure whether it qualifies should document its analysis and confirm its conclusion with counsel.

Covered Individuals

The statute applies to administrators, employees, and regular volunteers, and it defines a “regular volunteer” as “a volunteer with the youth service organization who is 18 years of age or older and who has direct contact with, or supervision of, children for more than 16 hours per month or 32 hours per year.” Volunteers below those thresholds fall outside the statutory mandate, although Penal Code Section 11105.3 permits a qualified entity to screen any current or prospective volunteer who has or may have access to the people it serves, and many organizations choose to screen every volunteer who works with children as a matter of policy.

Statutory Obligations

Section 18975 imposes the following obligations on every youth service organization:

Training. Every administrator, employee, and regular volunteer must “complete training in child abuse and neglect identification and training in child abuse and neglect reporting,” and the statute provides that this requirement “may be met by completing the online mandated reporter training provided by the Office of Child Abuse Prevention in the State Department of Social Services.”
Background checks. Every administrator, employee, and regular volunteer must “undergo a background check pursuant to Section 11105.3 of the Penal Code to identify and exclude any persons with a history of child abuse.” A transitional exemption for organizations that did not conduct such checks before 2022 expired on January 1, 2024, so the requirement now applies to every covered organization.
External reporting policy. The organization must develop and implement “policies to ensure reporting of suspected incidents of child abuse to persons or entities outside of the organization, including the reporting required pursuant to Section 11165.9 of the Penal Code.”
Two mandated reporter policy. The organization must develop and implement “policies requiring, to the greatest extent possible, the presence of at least two mandated reporters whenever administrators, employees, or volunteers are in contact with, or supervising, children.” A narrow exception applies to organizations providing one-to-one mentoring that have adopted the external reporting policy along with comprehensive volunteer screening, training of volunteers and parents or guardians, and regular contact with volunteers and parents or guardians.

The two mandated reporter policy deserves careful planning, because Penal Code Section 11165.7 provides that, apart from school and Court Appointed Special Advocate volunteers, “volunteers of public or private organizations whose duties require direct contact with and supervision of children are not mandated reporters.” An organization that staffs its children’s programs mainly with volunteers should review with counsel how its staffing and supervision plans meet the statutory standard.

Section 18975 also provides that, before writing liability insurance for a youth service organization, “an insurer may request information demonstrating compliance with this section from the youth service organization as a part of the insurer’s loss control program.” Underwriting is often the practical point at which compliance is examined, so an organization should keep its training records, screening records, and adopted policies organized and ready to produce.

Background Check Authority Under Penal Code Section 11105.3

AB 2796 recast Penal Code Section 11105.3 so that it now directs DOJ to develop the CalVECHS program to implement the National Child Protection Act of 1993, as amended by the Volunteers for Children Act. The section now provides that “notwithstanding any other law, a qualified entity may require a covered individual to undergo a fingerprint-based state and national criminal history background check,” and that “a qualified entity shall request from the department subsequent notification service for covered individuals.” Read together with Section 18975, the background check AB 506 requires is now the fingerprint-based state and national check conducted through CalVECHS, accompanied by mandatory subsequent arrest notification. Organizations should confirm this reading with counsel or DOJ, because DOJ’s published guidance and the CalVECHS regulations were issued before AB 2796 took effect.

The statute defines a “qualified entity” as “a business or organization, whether public, private, for profit, not for profit, or voluntary, that provides care or licenses, certifies, or places others to provide care,” and it defines “care” as “the provision of services, treatment, education, training, instruction, supervision, or recreation to children, the elderly, or an individual with a disability.” Section 11105.3 places the following duties on every qualified entity:

register with DOJ and sign an agreement to comply with state and federal law before submitting any screening request, subject to periodic DOJ audit;
“maintain a waiver signed by the covered individual allowing the release of the state- and federal-level criminal history information to the qualified entity”;
make its own fitness determination, because that determination “shall solely be made by the qualified entity”;
notify each person in writing of the right to obtain a copy of the background screening report, to challenge the accuracy and completeness of its contents, and to obtain a determination on that challenge “before a final determination regarding the person is made by the qualified entity”; and
keep criminal history information confidential and use it only for the purpose for which it was acquired.

The statute also provides that “a fee shall not be charged to a nonprofit organization for requesting the state records of a covered individual.” Results are delivered to the organization’s custodian of records, and Penal Code Section 11102.2 provides that “every agency must designate at least one custodian of records,” an individual “responsible for the security, storage, dissemination, and destruction of the criminal records furnished to the agency” who must be confirmed by DOJ after a fingerprint-based background clearance before serving in that role.

The CalVECHS Program

Purpose of the Program

Federal law generally prevents DOJ from releasing federal criminal history records to private organizations, and CalVECHS is the state program, authorized under the National Child Protection Act and the Volunteers for Children Act, that allows qualified entities serving children, the elderly, or individuals with disabilities to receive both state and federal results on their current and prospective employees and volunteers. DOJ explains that organizations outside CalVECHS receive “a sanitized federal response from DOJ that confirms the FBI has performed an applicant’s federal background check, but does not include out-of-state criminal records if any exist.” Enrollment therefore closes a real gap in screening, because an applicant’s out-of-state criminal history is disclosed to the organization only through CalVECHS.

Enrollment Deadline and Consequences

DOJ has stated that “all agencies currently authorized to fingerprint under California Penal Code 11105.3, including youth organizations and human resource agencies, are qualified to participate in CalVECHS and must be enrolled in CalVECHS by the end of 2026 in order to continue submitting applicant fingerprints and receiving state and federal CORI.” Information Bulletin 25-04 likewise advises that, beginning January 1, 2027, the FBI will no longer allow qualified entities to conduct federal background checks under Section 11105.3 unless they are enrolled. An organization that misses the deadline therefore risks losing the ability to submit new applicants at all, not merely the federal portion of the results, and with it the ability to complete the check AB 506 requires.

Enrollment is open now, because DOJ began accepting enrollment requests through its Applicant Agency Justice Connection (AAJC) portal when it issued Information Bulletin 25-04 in March 2025, and the regulations governing the program took effect on July 1, 2026.^, Organizations that have not enrolled should act immediately, since DOJ must review each request, determine whether the organization is eligible as a qualified entity, and notify the organization of its decision before enrollment is complete.

Enrollment Procedure

An organization that already holds DOJ authorization to fingerprint under Section 11105.3 enrolls by submitting a CalVECHS Enrollment request from the Requests page of the AAJC portal, and DOJ lists the following items for the submission package:

Authorized Recipient User Agreement (BCIA 9005);
CalVECHS User Agreement (BCIA 9017), which the regulations require for enrollment and which DOJ requires even from previously authorized agencies;
California Contract for Subsequent Arrest Notification Service (BCIA 8049);
Federal Contract for Subsequent Arrest Notification Service (BCIA 8050); and
a copy of the organization’s nonprofit status document or business license.

A nonprofit organization exempt under Internal Revenue Code Section 501(c)(3) should submit its IRS determination letter during enrollment to receive the exemption from state processing fees. DOJ charges no additional fee to participate in CalVECHS, and it reports that for nonprofit youth organizations the state fingerprint processing fee is $0 and the federal fingerprint processing fee is $15.

An organization that does not yet hold DOJ authorization must first apply through DOJ’s Agency Authorization Portal, because the regulations open CalVECHS enrollment only to an “authorized applicant agency” and DOJ approves only organizations that are authorized by statute.^, DOJ directs questions about CalVECHS qualification to ORIQuestions@doj.ca.gov, questions about agency authorization to AuthorizationQuestions@doj.ca.gov, and questions about its information bulletins to its Authorization and Certification Program at TASS@doj.ca.gov.^,,

Organizations Screened Under Other Statutes

CalVECHS is not available for personnel who must be fingerprinted under a different statute, and the regulations direct DOJ to deny enrollment to agencies whose applicants are required to undergo state and national checks under another FBI-approved statute. DOJ’s guidance identifies licensed daycare centers, public and private schools, and skilled nursing facilities as examples of entities that must follow the statutory requirements that apply specifically to them, so a church that also operates a licensed preschool or a private school should confirm with DOJ how each of its programs is to be screened.

Ongoing Program Obligations

Enrollment begins a set of continuing duties that an enrolled organization must build into its routine:

Annual waiver. Every covered individual must complete and sign the CalVECHS Waiver Agreement (BCIA 9018) “prior to fingerprinting and annually thereafter,” and the organization “must retain the CalVECHS Waiver Agreement for a minimum of three years or until a successful compliance audit has been assessed by the Department.” The form supports e-signature, and DOJ allows an organization to collect updated waivers from everyone on a single annual refresh date rather than tracking individual anniversaries.
Correct Live Scan form and applicant type. New applicants must be fingerprinted using the Request for Live Scan Service form BCIA 8016VECHS and submitted under the VECHS/EMPLOYEE 11105.3 PC or VECHS/VOLUNTEER 11105.3 PC applicant type, and an applicant who cannot be fingerprinted by Live Scan within California may submit an FD-258 fingerprint card instead.^,
Subsequent arrest notification and Federal Rap Back. CalVECHS participation requires enrollment in DOJ’s subsequent arrest notification services, and Information Bulletin 25-13 announced that the FBI’s Federal Rap Back Service, which provides notice of later out-of-state arrests and dispositions, is now available and directed youth organizations to Information Bulletin 25-04 for enrollment.^, Federal Rap Back subscriptions must be renewed through the AAJC portal every five years.
No Longer Interested notices. When an applicant’s employment is terminated, or an applicant is not chosen or is denied approval, the organization must submit a No Longer Interested (NLI) request in the AAJC portal within five days, and it must reconcile its active applicant list by verifying that a relationship still exists with each person listed.
Compliance audits. The regulations provide that DOJ “shall conduct triennial audits of qualified entities to ensure compliance with these regulations,” and DOJ has stated that its audits of enrolled agencies will review the program requirements.^,
Secure handling of records. The custodian of records must keep criminal history information confidential, store it securely, and use it only for screening covered individuals.^,

Previously Fingerprinted Personnel

DOJ has advised that employees and volunteers of existing authorized agencies “are not required to immediately resubmit fingerprints after an agency enrolls,” but it has also explained that an organization receives the full federal response only for people fingerprinted under the VECHS applicant types, and that Federal Rap Back does not cover applicants fingerprinted before the organization subscribed unless they resubmit their fingerprints.^, AB 2796 added Penal Code Section 11105.003, which allows an entity to make decisions based on a state check until the FBI authorizes it to conduct federal checks and then provides that “the entity shall require an applicant, licensee, certified individual, and employee who did not previously undergo the federal criminal history information check to resubmit their fingerprints for that purpose.” Organizations should plan and budget for reprinting existing personnel who have not had a full federal check, confirm with counsel or DOJ how Section 11105.003 applies to them, and watch for the future DOJ announcement on previously printed applicants that Information Bulletin 25-13 anticipates.

Recommendations

Kearnan Consulting Group recommends that California youth service organizations take the following steps without delay:

Confirm coverage. Document whether your organization is a youth service organization under Section 18975 and identify every administrator, employee, and regular volunteer, including each volunteer 18 or older who exceeds 16 hours per month or 32 hours per year of direct contact with or supervision of children.
Enroll in CalVECHS before January 1, 2027. If you already fingerprint under Section 11105.3, submit the CalVECHS Enrollment request and the complete package through the AAJC portal now, and if you do not yet hold DOJ authorization, begin your Agency Authorization Portal application immediately.
Enroll in subsequent notification and Federal Rap Back. Confirm that state subsequent arrest notification is active and that your Federal Rap Back request has been submitted.
Implement the annual waiver process. Collect a signed BCIA 9018 waiver from every covered individual before fingerprinting, set an annual refresh date, and retain each waiver for at least three years or until a successful DOJ audit.
Audit current screening and plan for reprinting. Verify that every covered person has a completed Live Scan on file, identify those fingerprinted under the older applicant types, and plan and budget for resubmission.
Update Live Scan instructions. Direct every new applicant to use form BCIA 8016VECHS and the correct VECHS applicant type.
Establish NLI and reconciliation procedures. Assign responsibility for filing NLI requests within five days and for reconciling the active applicant list on a regular schedule.
Designate and confirm a custodian of records. Ensure that at least one custodian of records has been confirmed by DOJ and understands the confidentiality, storage, and destruction requirements.
Adopt a written notice of rights. Use a written notice informing each person of the right to obtain and challenge the background screening report before a final determination is made.
Verify training. Confirm that every covered individual has completed training in child abuse and neglect identification and reporting, and keep dated completion records.
Adopt and implement the required policies. Confirm that your governing board has approved an external reporting policy and a two mandated reporter policy, that both are distributed to staff and volunteers and followed in practice, and that both are reviewed annually.
Coordinate with your insurer and counsel. Keep compliance documentation ready for your liability carrier, and have California counsel review your program, particularly how the AB 2796 amendments and Section 11105.003 apply to your organization.

Compliance Checklist

Requirement	Status to Confirm
Youth service organization status and covered individuals documented	In place / Pending
Child abuse and neglect training completed and recorded for all covered individuals	In place / Pending
External reporting policy adopted and implemented	In place / Pending
Two mandated reporter policy adopted and implemented	In place / Pending
DOJ applicant agency authorization in place	In place / Pending
CalVECHS enrollment approved (before January 1, 2027)	In place / Pending
State subsequent arrest notification and Federal Rap Back enrollment	In place / Pending
Signed BCIA 9018 waivers on file for all covered individuals and renewed annually	In place / Pending
New applicants submitted on BCIA 8016VECHS under VECHS applicant types	In place / Pending
Resubmission plan for previously fingerprinted personnel	In place / Pending
Custodian of records confirmed by DOJ	In place / Pending
Written notice of the right to obtain and challenge reports in use	In place / Pending
NLI filing and applicant reconciliation responsibilities assigned	In place / Pending
Waivers and records retained for audit (minimum three years)	In place / Pending
Compliance documentation ready for liability insurer	In place / Pending

How Kearnan Consulting Group Can Help

Kearnan Consulting Group helps California nonprofits and houses of worship translate these requirements into practical, board ready compliance programs. We can assess your coverage and current screening, map your CalVECHS and Federal Rap Back enrollment steps, review or draft your external reporting and two mandated reporter policies, and prepare documentation for your insurer. Contact us to discuss a compliance review tailored to your programs.