Background Checks and the FCRA: What You Must Do Before and After
Background checks are routine, and the procedure around them is not. The Fair Credit Reporting Act imposes specific steps before and after, and the most common violations are procedural rather than substantive — the check was fine, the paperwork was not.
For a related Monitask resource on how workplace monitoring is disclosed, see the reference.
FCRA claims are frequently brought as class actions, because a defective disclosure form is defective for every applicant who received it.
General information, not legal advice. Have your process and forms reviewed by employment counsel.
When the FCRA applies
Whenever you use a third party — a consumer reporting agency — to obtain a report on an applicant or employee. Criminal history, employment verification, education verification, credit reports, motor vehicle records.
It does not apply to checks you conduct entirely yourself, though other laws still do.
Before the check
1. Standalone written disclosure. A clear statement that a consumer report may be obtained for employment purposes.
"Standalone" is the requirement that gets violated most. The disclosure must be in a document consisting solely of that disclosure. Not embedded in the application. Not on the same page as a liability waiver. Not combined with state-law notices. Courts have found violations where extra language was included, however reasonable it seemed.
2. Written authorisation from the applicant. This may appear on the same document as the disclosure.
3. Certification to the agency that you have complied and will not use the information in violation of equal opportunity laws.
After the check, if it affects your decision
A two-step process. Both steps are required.
Step one — pre-adverse action. Before you decide, send: - A copy of the report - A copy of "A Summary of Your Rights Under the Fair Credit Reporting Act"
Then wait a reasonable period before acting. Five business days is a common practice, and the point is real: the applicant needs a genuine opportunity to review the report and dispute inaccuracies. Reports do contain errors, including records belonging to someone else with a similar name.
Step two — adverse action notice. After that period, if you proceed, send a notice stating: - The decision - The name, address and phone number of the reporting agency - That the agency did not make the decision and cannot explain it - The right to a free copy of the report within 60 days - The right to dispute the accuracy of the information
Skipping step one and sending only a rejection is the single most common FCRA failure in hiring.
State and local rules on criminal history
Layered on top of the FCRA, and often stricter.
Ban the box. Many states and cities restrict when criminal history may be asked about — commonly after a conditional offer rather than on the application.
Individualised assessment. Several jurisdictions require you to consider the nature of the offence, the time elapsed, and its relationship to the job, rather than applying a blanket exclusion. Federal enforcement guidance has long taken a similar view, on the basis that blanket exclusions can have a disparate impact.
Lookback limits. Some states restrict how far back convictions may be considered, and many limit or prohibit use of arrests that did not lead to conviction.
Notice and reconsideration. Some jurisdictions require a specific written assessment and an opportunity for the applicant to respond before a final decision.
Credit checks
Restricted in a number of states except for defined role types — typically positions with financial responsibility or access to sensitive information.
Ask whether you actually need one. Credit reports are among the least job-relevant checks for most roles and among the most regulated.
Salary history
Prohibited or restricted in a growing number of states and cities, and it can appear inadvertently in employment verification reports. Instruct your provider not to collect or report it where prohibited.
Practical guidance
Apply the same check to everyone in the same role. Running deeper checks on some candidates than others creates discrimination exposure and undermines any consistent-process defence.
Check after a conditional offer, not at application, unless a specific role requires otherwise. This is the safest default, and in many jurisdictions it is required.
Define relevance in advance. Which offences would actually disqualify someone from this role, and why. Written before you see any results, not decided after.
Use a reputable provider who understands FCRA compliance and jurisdiction-specific rules, and review their forms rather than assuming they are correct. Your liability, not theirs.
Document the assessment where a record is considered and the person is hired anyway, as well as where they are not.
Do not act on information you happen to find outside the formal process — a social media search, something a colleague mentioned. It sits outside your documented process and is difficult to defend.
A short compliance check
- [ ] Disclosure is genuinely standalone, containing nothing else
- [ ] Written authorisation obtained
- [ ] Certification provided to the agency
- [ ] Checks timed to comply with local ban-the-box rules
- [ ] Pre-adverse action notice sent with the report and rights summary
- [ ] Reasonable waiting period observed before deciding
- [ ] Adverse action notice contains all required elements
- [ ] Individualised assessment documented where required
- [ ] Same checks applied consistently within a role
- [ ] Forms reviewed by counsel within the last year
PJP runs background checks as part of placement, with the FCRA process handled properly. Services → For broader reference, consult FTC guidance on background checks.