You have found the right candidate, the offer is almost ready, and the last step is a background check. Many employers treat this as a formality: click a button on a screening vendor's site and wait for the report. But the moment you use a third-party company to run that check, a federal law called the Fair Credit Reporting Act (FCRA) applies, along with a strict set of procedural rules. FCRA claims are a frequent source of class actions, often over technical mistakes in paperwork rather than anything the employer meant to do.
Here is how to run background checks the right way, from the disclosure form to the final adverse action notice.
When the FCRA applies
The FCRA applies when an employer obtains a consumer report from a consumer reporting agency for employment purposes. In plain terms, if you pay a background check company to compile information on a candidate or employee, the FCRA almost certainly applies. That includes:
- Criminal history checks
- Credit reports
- Motor vehicle records
- Employment and education verifications run by a screening company
- Reference checks conducted by a third party
It applies to employers of any size, and to checks on current employees (for promotions or retention decisions) as well as applicants. If you do the research entirely yourself, such as calling a former employer, the FCRA generally does not apply, though state laws and anti-discrimination laws still do.
Step 1: Give a standalone disclosure
Before requesting the report, you must give the candidate a clear and conspicuous written disclosure that a consumer report may be obtained for employment purposes. The disclosure must be in a document that consists solely of the disclosure.
This is where many employers get into trouble. Courts have found violations when the disclosure was bundled into an employment application or packed with extra content, such as liability waivers, lengthy state law notices or unrelated acknowledgments. Keep the disclosure short and separate.
Step 2: Get written authorization
You must get the candidate's written authorization before obtaining the report. Authorization can be included on the disclosure form itself, and electronic signatures are generally acceptable. You must also certify to the screening company that you have complied with the FCRA and will follow its adverse action rules. Most vendors build this certification into their onboarding.
If the report will be an investigative consumer report, meaning it includes information gathered through personal interviews with neighbors, friends or associates, additional disclosure requirements apply.
Step 3: Review the report fairly
The FCRA governs process, but other laws govern how you use the information. Title VII of the Civil Rights Act prohibits employment practices that have an unjustified disparate impact on protected groups, and blanket policies excluding anyone with a criminal record can raise that concern. EEOC guidance encourages employers to consider:
- The nature and gravity of the offense
- The time that has passed since the offense or completion of the sentence
- The nature of the job held or sought
An individualized assessment, which gives the candidate a chance to explain circumstances, rehabilitation or errors in the record, is a best practice and is required by some state and local laws.
Step 4: Send a pre-adverse action notice
If you are considering not hiring, rescinding an offer, or taking other adverse action based in whole or in part on the report, you must first give the candidate:
- A pre-adverse action notice
- A copy of the consumer report
- A copy of "A Summary of Your Rights Under the Fair Credit Reporting Act"
Then wait a reasonable period before making a final decision, so the candidate can review the report and dispute inaccuracies. The FCRA does not specify an exact number of days; many employers wait at least five business days. Some state and local laws set specific waiting periods.
Step 5: Send the adverse action notice
If you make a final decision to take adverse action, send an adverse action notice that includes:
- The name, address and phone number of the consumer reporting agency
- A statement that the agency did not make the decision and cannot explain why it was made
- Notice of the candidate's right to dispute the accuracy or completeness of the report with the agency
- Notice of the right to a free copy of the report from the agency within 60 days
FCRA process at a glance
| Step | Requirement | Common mistake |
|---|---|---|
| Disclosure | Clear written notice in a standalone document | Adding liability waivers or extra text |
| Authorization | Written consent before the report is obtained | Running the check before the form is signed |
| Certification | Certify FCRA compliance to the screening company | Not reading what the vendor contract certifies |
| Pre-adverse action | Notice, copy of report, Summary of Rights | Skipping straight to rejection |
| Waiting period | Reasonable time to respond and dispute | Deciding the same day |
| Adverse action | Final notice with agency details and rights | Missing required content |
Ban-the-box and fair chance laws
Many states, counties and cities have "ban-the-box" or fair chance hiring laws. These vary widely, but they commonly:
- Prohibit asking about criminal history on the job application
- Delay criminal history inquiries until after an interview or a conditional offer
- Require an individualized assessment before rejecting a candidate
- Require a specific notice and response period, sometimes in addition to FCRA notices
- Restrict consideration of arrests that did not lead to conviction, sealed or expunged records, or older convictions
Some apply to all private employers, some only to employers above a certain size, and some only to public employers. Several states and cities also restrict credit checks for most jobs. At the federal level, the Fair Chance to Compete for Jobs Act limits criminal history inquiries before a conditional offer for federal agencies and federal contractors. Check your state in the AskHrAI state HR law guides, and also check city rules where you hire.
Ban-the-box rules interact with how you write applications and interview questions. For related guidance, see the AskHrAI interview questions guide.
Practical tips
- Run checks only after a conditional offer, which simplifies compliance with many fair chance laws.
- Apply the same screening package to everyone in the same role.
- Choose checks relevant to the job; a driving record makes sense for a delivery driver, less so for a bookkeeper.
- Keep reports confidential and dispose of them securely when no longer needed.
- Review your vendor's forms yourself. You remain responsible for compliance even when the vendor supplies the paperwork.
- If state law provides a stricter rule (such as a longer waiting period or additional notice), follow both.
Key takeaways
- The FCRA applies whenever you use a third-party screening company, regardless of your size.
- Use a standalone disclosure, get written authorization, and certify compliance to the vendor.
- Before rejecting a candidate based on a report, send a pre-adverse action notice with the report and Summary of Rights, then wait.
- Finish with a proper adverse action notice.
- Ban-the-box and fair chance laws vary by state and city, so check local rules before you ask.
Have a question about a specific background check situation? Ask the AskHrAI HR assistant for guidance tailored to your state.
This article is general information, not legal advice. Employment laws change and vary by state and city — confirm details with your state labor department or an employment attorney.