OPINION

WARDLAW, Circuit Judge:

The modern information age has shined a spotlight on information privacy, and on the widespread use of consumer credit reports to collect information in violation of consumers' privacy rights. This case presents a question of first impression in the federal courts of appeals: whether a prospective employer may satisfy the Fair Credit Reporting Act's ("FCRA") disclosure requirements by providing a job applicant with a disclosure that "a consumer report may be obtained for employment purposes" which simultaneously serves as a liability waiver for the prospective employer and others.1 See 15 U.S.C. § 1681b(b)(2)(A). We hold that a prospective employer violates Section 1681b(b)(2)(A) when it procures a job applicant's consumer report after including a liability waiver in the same document as the statutorily mandated disclosure. We also hold that, in light of the clear statutory language that the disclosure document must consist "solely" of the disclosure, a prospective employer's violation of the FCRA is "willful" when the employer includes terms in addition to the disclosure, such as the liability waiver here, before procuring a consumer report or causing one to be procured.

I.

A. Fair Credit Reporting Act.

Congress enacted the FCRA in 1970 in response to concerns about corporations' increasingly sophisticated use of consumers' personal information in making credit and other decisions. Fair Credit Reporting Act of 1970, Pub. L. 91-508, § 602, 84 Stat. 1114, 1128. Specifically, Congress recognized the need to "ensure fair and accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy." Safeco Ins. Co. v. Burr, 551 U.S. 47, 52, 127 S.Ct. 2201, 167 L.Ed.2d 1045 (2007). Congress thus required the use of reasonable procedures in procuring and using a "consumer report," defined as

15 U.S.C. § 1681a(d).

Congress amended the FCRA in 1996. Consumer Credit Reporting Reform Act of 1996, Pub. L. 104-208, § 2403, 110 Stat. 3009-426, 3009-431. It recognized "the significant amount of inaccurate information that was being reported by consumer reporting agencies and the difficulties that consumers faced getting such errors corrected." S. Rep. No. 108-166 at 5-6 (2003) (describing 1996 amendments). Congress was specifically concerned that prospective employers were obtaining and using consumer reports in a manner that violated job applicants' privacy rights. S. Rep. No. 104-185 at 35 (1995). The disclosure and authorization provision codified at 15 U.S.C. § 1681b(b)(2)(A) was intended to address this concern by requiring the prospective employer to disclose that it may obtain the applicant's consumer report for employment purposes and providing the means by which the prospective employee might prevent the prospective employer from doing so — withholding of authorization. S. Rep. No. 104-185 at 35. This provision furthers Congress's overarching purposes of ensuring accurate credit reporting, promoting efficient error correction, and protecting privacy. See Safeco, 551 U.S. at 52, 127 S.Ct. 2201. Indeed, in addition to securing job applicants' privacy rights by enabling them to withhold authorization to obtain their consumer reports, the provision promotes error correction by providing applicants with an opportunity to warn a prospective employer of errors in the report before the employer decides against hiring the applicant on the basis of information contained in the report.2

Congress prohibited procurement of consumer reports unless certain specified procedures were followed:

15 U.S.C. § 1681b(b)(2)(A). Congress amended the statute in 1998 to add language providing that the authorization may be made on the same document as the disclosure. Consumer Reporting Employment Clarification Act of 1998, Pub. L. 105-347, § 2, 112 Stat. 3208, 3208.

The FCRA provides a private right of action against those who violate its statutory requirements in procuring and using consumer reports. The affected consumer is entitled to actual damages for a negligent violation. 15 U.S.C. § 1681o. For a willful violation, however, a consumer may recover statutory damages ranging from $100 to $1,000, punitive damages, and attorney's fees and costs. 15 U.S.C. § 1681n.

B. Syed's Lawsuit Against M-I.

Syed applied for a job with M-I in 2011. M-I provided Syed with a document labeled "Pre-employment Disclosure Release." See Appendix A. The Disclosure Release informed Syed that his credit history and other information could be collected and used as a basis for the employment decision, authorized M-I to procure Syed's consumer report, and stipulated that, by signing the document, Syed was waiving his rights to sue M-I and its agents for violations of the FCRA. Syed's signature served simultaneously as an authorization for M-I to procure his consumer report, and as a broad release of liability.

The liability waiver at the heart of the present dispute reads as follows:

Appendix A.

Syed alleges that the Disclosure Release failed to satisfy the disclosure requirements mandated by 15 U.S.C. § 1681b(b)(2)(A). Syed does not contend that M-I's form contained too little information. Instead, he argues that it contained too much. Specifically, he alleges that M-I's inclusion of the liability waiver violated the statutory requirement that the disclosure document consist "solely" of the disclosure. See § 1681b(b)(2)(A)(i). Syed alleges that he realized M-I had violated the statute when, upon reviewing his personnel file, he noticed that M-I had procured his consumer report, in spite of the allegedly deficient disclosure with which it had provided him. He alleges that he filed the complaint within two years of reviewing his file.

On May 19, 2014, Syed filed a putative class action in district court on behalf of himself and any person whose consumer report was obtained by M-I after receiving a disclosure in violation of Section 1681b(b)(2)(A)(i) within the two-year limitations period. He sought statutory damages pursuant to Section 1681n(a)(1)(A), punitive damages pursuant to Section 1681n(a)(2), and attorney's fees and costs pursuant to Section 1681n(a)(3).3 Syed did not seek actual damages, which would have required proof of actual harm. See Crabill v. Trans Union, L.L.C., 259 F.3d 662, 664 (7th Cir. 2001) (citing cases).

The original complaint alleged that M-I's statutory violation had been "willful," the predicate for Syed's claimed statutory and punitive damages. See 15 U.S.C. § 1681n; see also Safeco, 551 U.S. at 53, 127 S.Ct. 2201. On August 28, 2014, the district court dismissed Syed's complaint for failure to state a claim, with leave to amend. It held that the allegation of willfulness consisted only of "labels and conclusions." See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007).

Syed filed his First Amended Complaint ("FAC") on September 2, 2014. The FAC sets forth the same factual and legal allegations as did the original complaint. However, it also includes citations to Federal Trade Commission ("FTC") staff opinion letters and district court opinions that Syed asserts support his position that M-I "knew or should have known about its legal obligations under the FCRA," thus rendering its statutory violation willful.

On October 23, 2014, the district court again dismissed Syed's FAC for failure to state a claim, this time without leave to amend. The district court reasoned that Syed had still not sufficiently pleaded willfulness. The court concluded that the FTC letters could not have "warned [M-I] away from the view it took" because they were informal staff opinions, not authoritative guidance. See Safeco, 551 U.S. at 70, 70 n.19, 127 S.Ct. 2201. Similarly, the court found that the judicial opinions cited by Syed did not demonstrate that M-I's conduct had been willful because the opinions issued after M-I had provided Syed the Disclosure Release in 2011.

II.

We have jurisdiction under 28 U.S.C. § 1291 to review the district court's final judgment dismissing with prejudice Syed's claims against M-I.

We review de novo the grant of a motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6). Fayer v. Vaughn, 649 F.3d 1061, 1063-64 (9th Cir. 2011). In so doing, we accept "all factual allegations in the complaint as true and construe the pleadings in the light most favorable to the nonmoving party." Knievel v. ESPN, 393 F.3d 1068, 1072 (9th Cir. 2005). In addition, "the district court's interpretation of a statute is a question of law which we review de novo." Pakootas v. Teck Cominco Metals, Ltd., 830 F.3d 975, 980 (9th Cir. 2016) (internal quotation marks omitted).

III.

Syed has established Article III standing. A plaintiff who alleges a "bare procedural violation" of the FCRA, "divorced from any concrete harm," fails to satisfy Article III's injury-in-fact requirement. Spokeo, Inc. v. Robins, ___ U.S. ___, 136 S.Ct. 1540, 1549, 194 L.Ed.2d 635 (2016). However, Syed alleges more than a "bare procedural violation." The disclosure requirement at issue, 15 U.S.C. § 1681b(b)(2)(A)(i), creates a right to information by requiring prospective employers to inform job applicants that they intend to procure their consumer reports as part of the employment application process. The authorization requirement, § 1681b(b)(2)(A)(ii), creates a right to privacy by enabling applicants to withhold permission to obtain the report from the prospective employer, and a concrete injury when applicants are deprived of their ability to meaningfully authorize the credit check. By providing a private cause of action for violations of Section 1681b(b)(2)(A), Congress has recognized the harm such violations cause, thereby articulating a "chain[] of causation that will give rise to a case or controversy." See Spokeo, 136 S.Ct. at 1549 (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 580, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) (Kennedy, J., concurring)). Therefore, Syed has Article III standing to bring this lawsuit. See Thomas v. FTS USA, LLC, 193 F.Supp.3d 623, No. 3:13-cv-825, 2016 WL 3653878, at *4-12 (E.D. Va. June 30, 2016) (holding that an improper disclosure under 15 U.S.C. § 1681b(b)(2)(A) causes "a concrete injury sufficient to confer standing").

IV.

A. M-I violated the FCRA by including a liability waiver on the same document as its disclosure.

Neither the Supreme Court nor any circuit court of appeals has addressed whether a prospective employer may satisfy 15 U.S.C. § 1681b(b)(2)(A) by providing a disclosure on a document that also includes a liability waiver. The district court avoided this interpretive question, holding only that M-I's view that it had not violated the FCRA, whether correct or not, was "not objectively unreasonable," and that M-I therefore could not be held liable for statutory or punitive damages. See Safeco, 551 U.S. at 69-70, 127 S.Ct. 2201. We conclude that the inclusion of the liability waiver did violate the FCRA, and next consider whether that violation was willful.

1. Section 1681b(b)(2)(A) unambiguously requires a document that "consists solely of the disclosure."

We must begin with the text of the statute. Where congressional intent "has been expressed in reasonably plain terms, that language must ordinarily be regarded as conclusive." Griffin v. Oceanic Contractors, Inc., 458 U.S. 564, 570, 102 S.Ct. 3245, 73 L.Ed.2d 973 (1982) (internal quotation marks omitted). And when "the meaning of the words seems to us to be intelligible upon a simple reading, ... we shall spend no time upon generalities concerning the principles of [statutory] interpretation." United States v. M.H. Pulaski Co., 243 U.S. 97, 106, 37 S.Ct. 346, 61 L.Ed. 617 (1917).

The ordinary meaning of "solely" is "[a]lone; singly" or "[e]ntirely; exclusively." American Heritage Dictionary of the English Language 1666 (5th ed. 2011). M-I argues that the statute's requirement that the disclosure appear on a "document that consists solely of the disclosure" is ambiguous because subsection (ii) of the provision provides that the consumer may authorize the procurement of a consumer report on the document containing the disclosure. See 15 U.S.C. § 1681b(b)(2)(A). If the statute allows for an authorization on the same document as the disclosure, M-I reasons, then the statute must not really require the document to "consist[ ] solely of the disclosure." See § 1681b(b)(2)(A). M-I thus urges us to find that Section 1681b(b)(2)(A) is internally inconsistent, and to give no effect to Congress's use of the term "solely."

However, contrary to M-I's contention, the statutory allowance for the consumer to "authorize in writing" the procurement of a consumer report on the same document as the disclosure does not undermine the requirement that the document consist "solely of the disclosure." The two clauses are consistent because the authorization clause is an express exception to the requirement that the document consist "solely of the disclosure." While the statute does not specifically designate it as such, the authorization clause immediately follows the disclosure clause, and makes express reference to it. See § 1681b(b)(2)(A)(ii). This is not a case where we must rationalize two plainly inconsistent subsections, or smooth over a "mistake in draftsmanship." Russello v. United States, 464 U.S. 16, 23, 104 S.Ct. 296, 78 L.Ed.2d 17 (1983). To the contrary, it is clear that Congress intended the two subsections to work together.

Allowing an authorization on the same document as the disclosure is consistent with the purpose of the statute. Congress passed Section 1681b(b)(2)(A) in order to protect consumers from "improper invasion[s] of privacy," S. Rep. No. 104-185 at 35 (1995), and the disclosure and authorization requirements fit hand in glove to achieve that purpose. Indeed, each would be largely ineffective on its own. Had the statute required disclosure without conditioning the procurement of a consumer report on the job applicant's authorization, it would have failed to give the applicant control over the procurement of the personal information contained in the consumer report. On the other hand, had the statute conditioned the procurement of a report on the job applicant's authorization without mandating clear disclosure by the prospective employer, Congress's purpose would have been frustrated because applicants would not understand what they were authorizing. The disclosure and authorization clauses therefore work in tandem to further the congressional purpose of protecting consumers from "improper invasion[s] of privacy." See id.

Congress reasonably could have concluded that permitting the consumer to provide an authorization on the same page as the disclosure would enhance the effectiveness of each clause. A job applicant may read a disclosure more closely if he understands that the potential employer may obtain his consumer report only if he signs an authorization for it to do so. The decision to authorize or deny the prospective employer's use of his report to accept or reject his employment application may be better informed if the authorization immediately follows the disclosure.

We thus reject M-I's argument that Section 1681b(b)(2)(A) is internally inconsistent. "It is our duty to give effect, if possible, to every clause and word of a statute." United States v. Menasche, 348 U.S. 528, 538-39, 75 S.Ct. 513, 99 L.Ed. 615 (1955) (internal quotation marks omitted). M-I's interpretation fails to give effect to the term "solely," violating the precept that "statutes should not be construed to make surplusage of any provision." Wilshire Westwood Assocs. v. Atl. Richfield Corp., 881 F.2d 801, 804 (9th Cir. 1989) (alterations and internal quotation marks omitted). That other FCRA provisions mandating disclosure omit the term "solely" is further evidence that Congress intended that term to carry meaning in 15 U.S.C. § 1681b(b)(2)(A)(i). See 15 U.S.C. §§ 1681d, 1681s-3.

2. The statute does not implicitly authorize the inclusion of a liability waiver in a disclosure document.

Congress's express exception to the "solely" requirement, allowing the disclosure document to also contain the authorization to procure a consumer report, does not mean that the statute contains other implicit exceptions as well. See United States v. Johnson, 529 U.S. 53, 58, 120 S.Ct. 1114, 146 L.Ed.2d 39 (2000). Indeed, in light of Congress's express grant of permission for the inclusion of an authorization, the familiar judicial maxim expressio unius est exclusio alterius counsels against finding additional, implied, exceptions. See Tenn. Valley Auth. v. Hill, 437 U.S. 153, 188, 98 S.Ct. 2279, 57 L.Ed.2d 117 (1978). We therefore reject M-I's contention that a liability waiver is an implicit exception to the "solely" requirement in 15 U.S.C. § 1681b(b)(2)(A)(i).

Moreover, "[a]n implied exception to an express statute is justifiable only when it comports with the basic purpose of the statute." Walker v. Fairbanks Inv. Co., 268 F.2d 48, 53 (9th Cir. 1959). Here, an implied exception permitting the inclusion of a liability waiver on the same document as the disclosure does not comport with the FCRA's basic purpose. To the contrary, it would frustrate Congress's goal of guarding a job applicant's right to control the dissemination of sensitive personal information. See 15 U.S.C. § 1681(a)(4); S. Rep. No. 104-185 at 35. An authorization requiring the job applicant's signature focuses the applicant's attention on the nature of the personal information the prospective employer may obtain, and the employer's inability to obtain that information without his consent. But a liability waiver does just the opposite — it pulls the applicant's attention away from his privacy rights protected by the FCRA by calling his attention to the rights he must forego if he signs the document. Indeed, by reading M-I's Disclosure Release, a job applicant could reasonably conclude that his signature was not consent to the procurement of the consumer report, but to a broad release of the employer from claims arising from the totality of the "investigative background inquiries" referenced in the first sentence of the form. See Appendix A. Thus, 15 U.S.C. § 1681b(b)(2)(A) does not contain an implied exception allowing a prospective employer to include a liability waiver on the same document as the statutorily mandated disclosure.

3. The statute's explicit language cannot be interpreted as permitting the inclusion of a liability waiver.

M-I also argues that the statute contains an explicit exception allowing for the inclusion of a liability waiver, positing that a liability waiver is one type of authorization. But we need not speculate about how broadly Congress intended us to read the term "authorization," because Congress told us exactly what it meant when it described the authorization as encompassing only "the procurement of [a consumer] report." 15 U.S.C. § 1681b(b)(2)(A)(ii). Further, even assuming the statute were not as clear as it is, M-I's interpretation is inconsistent with the plain meaning of the term "authorize." To authorize is to "grant authority or power to." American Heritage Dictionary 120. To waive is to "give up ... voluntarily" or "relinquish." Id. at 1947. Authorization bestows, whereas waiver abdicates. A consumer may authorize the procurement of a consumer report or waive an employer's liability, but he may not "authorize" a "waiver." We decline to so harry the English language. See Int'l Primate Prot. League v. Adm'rs of Tulane Educ. Fund, 500 U.S. 72, 82, 111 S.Ct. 1700, 114 L.Ed.2d 134 (1991). We thus reject M-I's argument that the statute somehow explicitly permits the inclusion of a liability waiver on the disclosure document.4

4. Whether the disclosure is "clear and conspicuous" is irrelevant to the analysis.

Next, M-I suggests that its inclusion of a liability waiver was permissible because even with the waiver, the disclosure was still "clear and conspicuous." M-I cites Smith v. Waverly Partners, LLC, No. 3:10-CV-00028-RLV-DSC, 2012 WL 3645324, at *6 (W.D.N.C. Aug. 23, 2012), for the proposition that a disclosure made pursuant to Section 1681b(b)(2)(A) is valid despite the inclusion of a liability waiver where the waiver is "not so great a distraction as to discount the effectiveness of the disclosure." The district court in Smith concluded that "in order to give Congress's inclusion of the word `solely' meaningful effect, ... inclusion of the waiver provision was statutorily impermissible and ... the waiver is therefore invalid." Id. Only then, analyzing the single, separated sentence releasing the company from liability, did the court hold that the waiver was "not so great a distraction as to discount the effectiveness of the disclosure." Id. It is inexplicable to us that a court would find that including a waiver violated the FCRA, but because the disclosure was "clear and conspicuous," an additional requirement under the FCRA, see 15 U.S.C. § 1681b(b)(2)(A)(i), the disclosure was nonetheless "adequate." See Smith, 2012 WL 3645324, at *6. Because the question of whether a disclosure is "clear and conspicuous" within the meaning of Section 1681b(b)(2)(A)(i) is separate from the question of whether a document consists "solely" of a disclosure, and is not one that is before us here, we decide only that including the waiver violated the statute's "solely" requirement. Further, we question whether the Smith court's approach comports with the clear mandate and purpose of the FCRA's disclosure procedures.

B. M-I's statutory violation was willful as a matter of law.

Syed seeks statutory and punitive damages only, not actual damages. Statutory and punitive damages are available under the FCRA only where a defendant "willfully fails to comply" with the statute. 15 U.S.C. § 1681n(a). Therefore, we must decide whether M-I willfully failed to comply with Section 1681b(b)(2)(A) by procuring Syed's consumer report after including a liability waiver on the same document as the statutorily mandated disclosure. We may resolve this question as a matter of law, as the parties acknowledge.

The Supreme Court has clarified that, under Section 1681n, willfulness reaches actions taken in "reckless disregard of statutory duty," in addition to actions "known to violate the Act." Safeco, 551 U.S. at 56-57, 127 S.Ct. 2201. A party does not act in reckless disregard of the FCRA "unless the action is not only a violation under a reasonable reading of the statute's terms, but shows that the company ran a risk of violating the law substantially greater than the risk associated with a reading that was merely careless." Id. at 69, 127 S.Ct. 2201.

1. M-I's interpretation of the statute was not objectively reasonable.

M-I contends that, even if it violated the statute by procuring Syed's consumer report, its interpretation of 15 U.S.C. § 1681b(b)(2)(A) was not so erroneous that its non-compliance was willful within the meaning of Section 1681n. Indeed, M-I argues that its reading was not "objectively unreasonable" because the statutory text was "less[]than[]pellucid." See id. at 70, 127 S.Ct. 2201.

M-I's arguments on this score track its contentions as to why its actions did not violate the statute at all. However, for the reasons outlined above, we conclude that the FCRA unambiguously bars a prospective employer from including a liability waiver on a disclosure document provided a job applicant pursuant to Section 1681b(b)(2)(A).

M-I also contends that its interpretation of the statute is objectively reasonable in light of the dearth of guidance from federal appellate courts and administrative agencies. No court of appeals has spoken to the issue of whether a disclosure document provided pursuant to Section 1681b(b)(2)(A) may permissibly include a liability waiver. Nor has an administrative agency promulgated authoritative guidance on the issue.5

A lack of "guidance," however, does not itself render MI's interpretation reasonable. The Supreme Court has analogized the assessment of whether a FCRA violation may give rise to a claim for statutory damages to the determination of whether government employees may be held personally liable in suits for damages. Safeco, 551 U.S. at 70, 127 S.Ct. 2201. In the qualified immunity context, we have held that "when an officer's conduct is so patently violative of the constitutional right that reasonable officials would know without guidance from the courts that the action was unconstitutional, closely analogous pre-existing case law is not required to show that the law is clearly established." Boyd v. Benton Cty., 374 F.3d 773, 781 (9th Cir. 2004) (internal quotation marks omitted). Similarly, at least one circuit court of appeals has concluded that, in the FCRA context, a "lack of definitive authority does not, as a matter of law, immunize [a party] from potential liability" for statutory damages. Cortez v. Trans Union, LLC, 617 F.3d 688, 721 (3d Cir. 2010).

Despite the apparent dearth of guidance on the issue at the time M-I procured Syed's consumer report, M-I's inclusion of a liability waiver in the statutorily mandated disclosure document comports with no reasonable interpretation of 15 U.S.C. § 1681b(b)(2)(A). Therefore, we conclude that MI's interpretation was "objectively unreasonable."

2. M-I's non-compliance was willful.

The parties appear to assume that, under Safeco, an objectively unreasonable interpretation of the FCRA is by definition a reckless one, as well. However, this interpretation improperly conflates recklessness and negligence. In tort law, negligent actions are those which do not meet the standard of objective reasonableness. See Restatement (Second) of Torts § 283 comment c (Am. Law Inst. 1965); W. Page Keeton et al., Prosser and Keaton on The Law of Torts § 32, at 173-74 (5th ed. 1984). On the other hand, one acts recklessly when he creates an "unreasonable risk of physical harm to another" that is "substantially greater than that which is necessary to make his conduct negligent." See Restatement (Second) Torts § 500. The Supreme Court has specifically distinguished recklessness from negligence in the FCRA context, noting that a violation is only reckless (and therefore willful) where an employer adopts a reading of the statute that runs a risk of error "substantially greater than the risk associated with a reading that was merely careless." Safeco, 551 U.S. at 69, 127 S.Ct. 2201 (emphasis added); see also id. at 70, 127 S.Ct. 2201 ("Safeco's reading was not objectively unreasonable, and so falls well short of raising the `unjustifiably high risk' of violating the statute necessary for reckless liability.")

Moreover, equating negligence with recklessness would fail to give effect to the FCRA's allowance of actual damages for negligent violations, on the one hand, and statutory and punitive damages for willful ones, on the other. See 15 U.S.C. §§ 1681n, 1681o; Safeco, 551 U.S. at 69-70, 127 S.Ct. 2201; see also Menasche, 348 U.S. at 538-39, 75 S.Ct. 513 ("It is our duty to give effect, if possible, to every clause and word of a statute ....") (internal quotation marks omitted). Accordingly, if M-I's interpretation of the FCRA is merely objectively unreasonable, it does not follow that Syed is entitled to statutory damages.

We must determine whether M-I's interpretation of 15 U.S.C. § 1681b(b)(2)(A) to permit a liability waiver in a disclosure document crossed the "negligence/recklessness line." See Safeco, 551 U.S. at 69, 127 S.Ct. 2201. It is possible to imagine an interpretation of 15 U.S.C. § 1681b(b)(2)(A) that would be objectively unreasonable without rising to the level of recklessness. For instance, the Seventh Circuit has held that a company did not recklessly disregard the FCRA's mandate of "clear and conspicuous" disclosure by using six-point type, even if the company's actions were negligent. Murray v. New Cingular Wireless Servs., Inc., 523 F.3d 719, 726-27 (7th Cir. 2008) (Easterbrook, J.) (qualifying that such a practice "would be reckless today," given intervening legal authority).

Here, however, the term we are called upon to construe is not subject to a range of plausible interpretations. To the contrary, 15 U.S.C. § 1681b(b)(2)(A) unambiguously forecloses the inclusion of a liability waiver in a disclosure document. Thus, we need not consider M-I's subjective interpretation of the FCRA in determining whether it acted in reckless disregard of the statutory language, and therefore willfully. Indeed, M-I concedes that this question may be resolved purely as a matter of law.6 Because the statute unambiguously bars M-I's interpretation, whether or not M-I actually believed that its interpretation was correct is immaterial. See Reardon v. ClosetMaid Corp., No. 2:08-cv-01730, 2013 WL 6231606, at *11 (W.D. Pa. Dec. 2, 2013) (holding that there was "no issue of material fact" about whether defendant violated 15 U.S.C. § 1681b(b)(2)(A) willfully and granting plaintiff summary judgment).7 Notwithstanding that we are the first federal appellate court to construe Section 1681b(b)(2)(A), this is not a "borderline case." See Cortez, 617 F.3d at 722. An employer "whose conduct is first examined under [a] section of the Act should not receive a pass because the issue has never been decided." Id.

M-I ran an "unjustifiably high risk of violating the statute." See Safeco, 551 U.S. at 70, 127 S.Ct. 2201 (internal quotation marks omitted). In other words, M-I acted in "reckless disregard of statutory duty." Its violation of the FCRA was therefore willful under 15 U.S.C. § 1681n. See Safeco, 551 U.S. at 56-57, 127 S.Ct. 2201.

C. The complaint's factual allegations preclude dismissalon statute of limitations grounds.

In the alternative, M-I urges us to affirm the district court's dismissal of Syed's complaint on the ground that Syed's claims are barred by the FCRA's two-year statute of limitations. The FCRA requires a plaintiff to bring an action within the earlier of "(1) 2 years after the date of discovery by the plaintiff of the violation that is the basis for [the employer's] liability; or (2) 5 years after the date on which the violation that is the basis for such liability occurs." 15 U.S.C. § 1681p. The district court dismissed Syed's action because he failed to state a claim under Federal Rule of Civil Procedure 12(b)(6), not because the claim was time-barred. However, we may "affirm on any basis fairly supported by the record." Corrie v. Caterpillar, Inc., 503 F.3d 974, 979 (9th Cir. 2007).

M-I argues that Syed "discovered" the violation within the meaning of 15 U.S.C. § 1681p when he signed M-I's allegedly deficient Disclosure Release form upon applying for a job in 2011. Because Syed challenges only the disclosure document, and not the manner in which M-I used his consumer report, M-I contends that the date of disclosure is the relevant one here.

However, a prospective employer does not violate Section 1681b(b)(2)(A) by providing a disclosure that violates the FCRA's disclosure requirement. See Harris v. Home Depot U.S.A., Inc., 114 F.Supp.3d 868, 869 (N.D. Cal. 2015); Singleton v. Domino's Pizza, LLC, No. DKC 11-1823, 2012 WL 245965, at *7 (D. Md. Jan. 25, 2012). The employer violates the FCRA only where, after violating its disclosure procedures, it "procure[s] or cause[s] to be procured" a consumer report about the job applicant. See 15 U.S.C. § 1681b(b)(2)(A)(i).

M-I urges a contrary interpretation, relying on cases construing statutes of limitations involving inadequate disclosures on loan documents under the Fair and Accurate Credit Transactions Act of 2003 ("FACTA"), Pub. L. 108-159, 111 Stat. 1952, which amended the FCRA, and the Truth in Lending Act of 1968 ("TILA"), Pub. L. 90-321, 82 Stat. 146 (codified at 15 U.S.C. § 1601 et seq). M-I is correct that the statutes of limitations under FACTA and TILA generally begin to run when the disclosure is made. However, this is so because the disclosure and transaction usually occur simultaneously in the lending context. See Ancheta v. Golden Empire Mortg., Inc., No. 10-CV-05589-LHK, 2011 WL 826177, at *4 (N.D. Cal. March 7, 2011) ("FACTA claims presumptively accrue on the date of the loan transaction, because it should be clear on this date whether or not a credit score disclosure is made.").

Here, Syed does not allege that M-I procured his consumer report at the same time it made its disclosure, which would have meant that he could have discovered the statutory violation when he received the Disclosure Release. To the contrary, he alleges that he was unaware M-I had procured his consumer report until he reviewed his personnel file "within the last two years." Because we must treat this allegation as true at the motion-to-dismiss stage, Syed adequately pleaded that his claim fell within the FCRA's two-year statute of limitations. See Supermail Cargo, Inc. v. United States, 68 F.3d 1204, 1207 (9th Cir. 1995) ("[A] complaint cannot be dismissed [for untimeliness] unless it appears beyond doubt that the plaintiff can prove no set of facts that would establish the timeliness of the claim."). Therefore, dismissal of Syed's complaint was not warranted on the ground that his claim was time-barred.

V.

The FCRA's employment disclosure provision "says what it means and means what it says." See Simmons v. Himmelreich, ___ U.S. ___, 136 S.Ct. 1843, 1848, 195 L.Ed.2d 106 (2016). The statute unambiguously bars the inclusion of a liability waiver on the same document as a disclosure made pursuant to 15 U.S.C. § 1681b(b)(2)(A). M-I willfully violated the statute by procuring Syed's consumer report without providing a disclosure "in a document that consist[ed] solely of the disclosure." § 1681b(b)(2)(A)(i). Therefore, the district court erred in dismissing Syed's complaint.

REVERSED and REMANDED.

APPENDIX A