Background Check Compliance: FCRA, Ban-the-Box, and Fair Hiring Practices

6/8/2026

Background check compliance produces more class action litigation than almost any other HR process, and for a structural reason: the violations are procedural and uniform. If your disclosure form is defective, it is defective for every applicant you have ever processed.

Quick answer: Employers using a third-party background check must follow the FCRA's disclosure, authorization, pre-adverse action, and adverse action sequence exactly. Separately, state and local fair chance laws govern when criminal history may be asked about and how it may be used, usually requiring an individualized assessment before rejection.

Part One: The FCRA Sequence

Any background check obtained through a consumer reporting agency — which includes essentially every commercial vendor — triggers FCRA obligations. There are four mandatory steps and they must happen in order.

Step 1: Disclosure

Before obtaining a report, provide a clear and conspicuous written disclosure that a consumer report may be obtained for employment purposes.

The standalone requirement is where employers fail. The disclosure must be in a document consisting solely of the disclosure. Courts have found the following extraneous content to violate the requirement:

• Liability waivers or releases
• At-will employment statements
• State-law notices bundled into the same document
• Certifications about the accuracy of the application
• Acknowledgments of other policies

The authorization may generally appear on the same document as the disclosure. Almost nothing else may.

Step 2: Authorization

Obtain the applicant's written authorization before requesting the report. Electronic authorization is acceptable if it meets the applicable standards.

Step 3: Pre-adverse action notice

Before taking any adverse action based in whole or in part on the report, provide:

• A pre-adverse action notice
• A copy of the consumer report
• A copy of "A Summary of Your Rights Under the Fair Credit Reporting Act"

Then wait a reasonable period before acting, so the applicant can review and dispute inaccuracies. Five business days is the common practice; some jurisdictions require longer. The purpose is genuine — background reports contain errors at a meaningful rate, including mismatched identities.

Step 4: Adverse action notice

After the waiting period, if you proceed, provide a notice stating:

• That adverse action was taken based in whole or in part on the report
• The name, address, and phone number of the consumer reporting agency
• A statement that the agency did not make the decision and cannot explain it
• Notice of the right to a free copy of the report within 60 days and the right to dispute its accuracy

Where the money is

FCRA violations support actual damages, statutory damages for willful violations, punitive damages, and attorney fees. Because the process is uniform, a single defective form produces class-wide exposure. The most common claims: defective standalone disclosure, missing pre-adverse action notice, and inadequate waiting period.

Part Two: Fair Chance and Ban-the-Box

Fair chance laws regulate the timing and use of criminal history. They exist at state, county, and city levels, and they differ in every dimension. Check each of these for every jurisdiction where you hire:

Variable	Common Variations
Timing of inquiry	After initial application; after first interview; only after a conditional offer
Scope of coverage	Public employers only; public and private; contractor coverage; size thresholds
What may be considered	Restrictions on arrests without conviction, sealed or expunged records, and convictions older than a defined lookback period
Individualized assessment	Frequently required before rejection, with specified factors
Notice and response rights	A copy of the record, a written statement of the specific conviction relied on, and a defined period to respond — often longer than the FCRA's
Job posting language	Some jurisdictions require or prohibit specific statements about criminal history in postings

The Individualized Assessment

Even where no local law requires it, EEOC guidance identifies three factors for assessing criminal conduct in employment decisions:

1. The nature and gravity of the offense or conduct
2. The time that has passed since the offense, conduct, or completion of the sentence
3. The nature of the job held or sought

Where those factors suggest exclusion, the individualized assessment adds an opportunity for the individual to provide information about circumstances, rehabilitation, employment history since the offense, and other mitigating facts.

The underlying legal theory matters: because arrest and conviction rates differ across racial and ethnic groups, blanket criminal history exclusions can produce disparate impact under Title VII. A blanket policy — "no felonies, ever, for any position" — is difficult to defend as job related and consistent with business necessity.

Other Screening Categories

• Credit history. Restricted in a number of states except for specific position types. Where permitted, the job-relatedness argument must be genuine, and disparate impact analysis applies.
• Salary history. Prohibited in many jurisdictions — often obtained inadvertently through a background vendor's standard employment verification package. Audit the vendor's product scope.
• Social media. Reviewing public profiles is generally lawful, but it exposes protected characteristics the employer would otherwise not know, creating a difficult record. Several states prohibit requesting passwords or requiring access to private accounts. If you screen social media, do it through a firewalled process that reports only job-related findings.
• Driving records. Job-related for driving positions; document the connection for others.
• Drug testing. Increasingly restricted, particularly for cannabis, with several states limiting adverse action based on off-duty use or on tests that do not indicate current impairment.

A Compliant Process Design

1. Delay criminal history inquiry to post-conditional-offer It satisfies the strictest jurisdictions and simplifies the workflow to a single national process.
2. Rebuild the disclosure as a genuinely standalone document. Review it against the extraneous-content list above.
3. Separate state-required notices into their own documents.
4. Build the two-step adverse action workflow into the ATS with an enforced waiting period. Manual tracking fails.
5. Use a written individualized assessment form capturing the three factors and any information the candidate provides.
6. Define job-related screening criteria in advance, by position type, and document the business justification.
7. Audit your vendor's product for salary history, non-reportable records, and jurisdictional compliance.
8. Train recruiters on what may not be asked, and when.
9. Document everything — dates of each notice, copies sent, and the assessment.

Frequently Asked Questions

Can the disclosure be part of the employment application?

No. The FCRA requires a document consisting solely of the disclosure. Embedding it in an application is one of the most-litigated violations.

How long must we wait after the pre-adverse action notice?

The FCRA requires a reasonable period. Five business days is common practice; some jurisdictions require more. Set one standard and apply it uniformly.

Can we automatically reject applicants with felony convictions?

Blanket exclusions risk disparate impact liability and violate fair chance laws in many jurisdictions. Conduct an individualized assessment tied to the specific job.

Do we have to run the same check for every role?

No, and you generally should not. Screening should be job-related. Document criteria by position type in advance rather than deciding case by case.

Does the FCRA apply if we do the check ourselves?

The FCRA applies to reports obtained from a consumer reporting agency. Internal checks may fall outside it — but state law, EEOC guidance, and fair chance ordinances still apply.

Fix the Forms, Then the Process

Background check exposure is concentrated in paperwork most organizations have not reviewed in years. An afternoon spent on the disclosure form and the adverse action workflow eliminates the majority of the risk.

The HR Generalist Certificate Program covers hiring compliance including background screening and fair chance requirements. For broader coverage, see HR compliance training.

👉 Browse HR compliance training →

Additional resources: HR Compliance FAQ | HR Best Practices | EEOC guidance on arrest and conviction records