Running employee background checks legally means following the Fair Credit Reporting Act (FCRA), EEOC anti-discrimination rules, and a growing web of state and local laws before you screen a single candidate. Approximately 95% of U.S. businesses conduct pre-employment screening, yet most legal violations happen not from skipping checks entirely but from skipping the required steps around them. Get the process wrong and you face federal statutory damages of $100 to $1,000 per violation, plus exposure to discrimination claims. Get it right and you protect both your business and your candidates.
How to run employee background checks legally: prerequisites and documentation
Four mandatory steps must happen before you order any background check through a third-party screening company. Miss one and you are already in violation of the FCRA, regardless of what the report shows.
-
Issue a standalone written disclosure. The FCRA requires a separate document that tells the candidate you may obtain a consumer report for employment purposes. Bundling this disclosure into your application form, employee handbook, or onboarding packet is illegal and widely litigated. The document must contain only the required consumer report notice. Nothing else.
-
Obtain written authorization. The candidate must sign and date a separate authorization form before you contact any consumer reporting agency (CRA). This can be a paper form or a compliant electronic signature. Keep the signed copy on file.
-
Confirm a permissible purpose. Under the FCRA, employment is a recognized permissible purpose. You must have a clear, documented employment-related reason for running the check. A general curiosity about a candidate does not qualify.
-
Certify compliance to the CRA. When you order the report, you certify to the screening vendor that you have issued the disclosure, obtained authorization, and will follow all FCRA requirements including the adverse action process. Using a third-party CRA is the trigger point for federal screening statutes. In-house reference checks generally do not create the same obligations.
Pro Tip: Create a pre-check compliance checklist that your HR team signs off on before every single order. One missed step on one candidate is enough to trigger a class-action lawsuit.
Understanding what a background check covers helps you decide which type of report to order and which disclosures to tailor accordingly.
How do federal and state laws regulate the timing of background checks?
Timing is where most employers get caught. Federal law sets the floor. State and local laws often raise it significantly.
The FCRA governs the entire relationship between employers, CRAs, and candidates when third-party reports are involved. It requires proper notice, written authorization, and a two-step adverse action process. What it does not specify is exactly when in the hiring process you must run the check. That gap is filled by Ban-the-Box laws.
Over 35 states and 150+ local jurisdictions have enacted Ban-the-Box laws that restrict criminal background checks until after a conditional job offer is extended. That number has grown rapidly in recent years, and the trend continues. Employers who run criminal checks during the application stage in a covered jurisdiction are breaking the law before they even receive the report.
Key points to track across jurisdictions:
- Conditional offer requirement. In Ban-the-Box states, you must extend a written conditional offer before ordering a criminal background check.
- Waiting periods. Some cities, including New York City under its Fair Chance Act, require additional waiting periods and specific written notices before withdrawing an offer.
- Scope of restricted records. Certain states limit how far back a criminal history check can reach, typically 7 years for most offenses.
- Industry exemptions. Healthcare, childcare, and financial services roles often carry separate statutory requirements that override general Ban-the-Box protections.
Managing compliance across multiple jurisdictions manually is a high-risk approach. A candidate in one city may trigger a different set of rules than a candidate in the next county. Knowing how background check turnaround works helps you build realistic timelines that account for these legal waiting periods.
What is the mandatory adverse action process?
The adverse action process is the most misunderstood and most litigated part of legal employee screening. The FCRA mandates a two-step sequence any time a background check result negatively affects a hiring decision.
-
Send a pre-adverse action notice. Before you withdraw an offer or reject a candidate based on report findings, you must send a written pre-adverse action notice. This notice must include a copy of the background report and the Summary of Rights document provided by the Consumer Financial Protection Bureau (CFPB). The candidate must receive both before any final decision is communicated.
-
Wait at least 5 business days. The candidate has the right to review the report and dispute any inaccurate information. The FCRA requires a waiting period of at least 5 business days between the pre-adverse action notice and the final adverse action notice. Some state laws require longer waiting periods. Check your jurisdiction.
-
Send the final adverse action notice. After the waiting period, if you proceed with the negative decision, you must send a final adverse action notice. This notice must include the name and contact information of the CRA, a statement that the CRA did not make the hiring decision, and information on the candidate’s right to dispute the report.
-
Apply the process consistently. Every candidate whose report influences a negative decision must receive the same process. Selective application creates discrimination exposure.
The most dangerous assumption in background screening is that a clean report means you are done with compliance. Every report, positive or negative, triggers the same documentation and process obligations the moment you order it from a third party.
What are best practices for fair and compliant background checks?
A legally compliant background check program goes beyond paperwork. It requires consistent decision-making, documented policies, and the right tools.
Use the Nature-Time-Nature test for criminal records
The EEOC requires individualized assessments of criminal records rather than blanket exclusions. The Nature-Time-Nature test guides this process by evaluating three factors: the nature of the offense, the time elapsed since the offense, and the nature of the job. A decade-old misdemeanor is not automatically disqualifying for an office role. A recent fraud conviction may be directly relevant to a finance position. Document your reasoning for every decision.
Blanket exclusion policies, such as “we do not hire anyone with a felony conviction,” create serious disparate impact liability under Title VII. The EEOC has made clear that using blanket exclusions is a major legal liability, particularly when those policies disproportionately affect protected classes.
Build a consistent, documented workflow
- Centralize your process. One person or one team should own background check compliance. Decentralized processes produce inconsistent results and missed steps.
- Use automated workflows. Automated and centralized compliance tools manage variable local laws and timelines more reliably than manual spreadsheet tracking. Manual tracking frequently leads to missed notifications and violations.
- Retain records securely. Federal law and most state laws require you to retain background check records for a defined period, typically 1–5 years depending on the record type and jurisdiction. Dispose of records securely when the retention period ends.
- Train your hiring managers. The person making the final call must understand the individualized assessment requirement. A hiring manager who says “we just don’t hire people with records” creates liability regardless of what your written policy says.
Pro Tip: Review your background check policy annually. Ban-the-Box laws, FCRA guidance, and EEOC enforcement priorities all shift. A policy that was compliant in 2024 may not be compliant today.
| Compliance area | Common mistake | Correct practice |
|---|---|---|
| Disclosure document | Bundled into application form | Standalone document, no extra content |
| Timing of criminal check | Run during application stage | After conditional offer in Ban-the-Box jurisdictions |
| Adverse action | Skipping pre-adverse notice | Two-step process with CFPB Summary of Rights |
| Criminal record decisions | Blanket exclusion policy | Individualized Nature-Time-Nature assessment |
| Record retention | Deleting records immediately | Retain per federal and state requirements |
Exploring the full range of background check categories helps you decide which searches are legally appropriate for each role type.
Key Takeaways
Legal employee screening requires strict adherence to FCRA documentation rules, Ban-the-Box timing restrictions, and the EEOC’s individualized assessment standard before any hiring decision is made.
| Point | Details |
|---|---|
| Standalone disclosure is mandatory | Never bundle the FCRA disclosure into an application form or any other document. |
| Ban-the-Box laws restrict timing | Over 35 states require a conditional offer before running criminal background checks. |
| Adverse action is a two-step process | Send a pre-adverse notice with the report, wait at least 5 business days, then send the final notice. |
| Blanket exclusions create liability | Use the Nature-Time-Nature test to assess criminal records individually for every candidate. |
| Automate to reduce violations | Manual tracking of multi-jurisdiction compliance rules leads to missed steps and legal exposure. |
Why most background check programs fail on execution, not intent
Most HR teams I have worked with understand the rules in theory. The breakdown happens in practice, and it almost always comes down to two things: bundled disclosures and ignored local ordinances.
The disclosure document error is the most litigated FCRA issue for a reason. It feels harmless to add the disclosure to the application packet. It is not. Courts have consistently ruled against employers on this point, and the financial exposure adds up fast when you multiply violations across a hiring class.
The local ordinance problem is subtler. A small business hiring in three cities may be subject to three different Ban-the-Box timelines, three different waiting periods, and three different notice requirements. Most owners do not know this until they receive a complaint.
My honest recommendation: centralize your background check process under one compliance owner, invest in a screening platform that tracks jurisdiction-specific rules automatically, and schedule a legal review of your policy every 12 months. The background check services that earn high marks in independent testing are the ones that build compliance workflows directly into the product, not as an add-on.
The gap between a compliant program and a liability-generating one is rarely about intent. It is almost always about consistency and documentation. Build the habit before you need to defend it.
— TechStackTeam
Techstacktoday’s resources for compliant screening
HR professionals and small business owners need tools they can trust, not just rules to memorize. Techstacktoday reviews and ranks privacy and data services with the same hands-on rigor it applies to every category it covers.
Background screening sits at the intersection of data privacy and employment law. The tools you use to run checks, store candidate data, and manage records all carry their own compliance obligations. Techstacktoday’s data removal guides and privacy tool reviews help you understand how candidate data moves, where it is stored, and how to protect it. Start with the Techstacktoday main platform to find tested, ranked resources that match your business size and compliance needs.
FAQ
What does the FCRA require before running a background check?
The FCRA requires a standalone written disclosure, written authorization from the candidate, and certification to the consumer reporting agency before you order any report. Skipping any step exposes you to federal statutory damages of $100 to $1,000 per violation.
What is a Ban-the-Box law?
A Ban-the-Box law prohibits employers from asking about criminal history or running criminal background checks until after a conditional job offer is made. Over 35 states and 150+ local jurisdictions have enacted these laws.
How long must I wait after sending a pre-adverse action notice?
The FCRA requires a minimum waiting period of 5 business days between the pre-adverse action notice and the final adverse action notice. Some state and local laws require longer periods, so check your jurisdiction before proceeding.
Can I use a blanket “no felony” hiring policy?
No. The EEOC requires individualized assessments of criminal records using the Nature-Time-Nature test. Blanket exclusion policies create disparate impact liability under Title VII and are a recognized major legal risk.
Does the FCRA apply to in-house reference checks?
No. The FCRA applies when you use a third-party consumer reporting agency to obtain a background report. In-house manual reference checks generally do not trigger FCRA obligations, though other employment laws may still apply.