Background Check Policy Requirements for Employers

A background check policy for employers is the written procedure your organization follows to screen candidates and, in some cases, current employees, and it has to be built around the Fair Credit Reporting Act, EEOC guidance on criminal history, and any state or local fair-chance law that applies to your workforce. The policy exists to keep hiring consistent and defensible; getting even small procedural steps wrong is one of the most common triggers for class-action litigation against employers.

The FCRA obligation kicks in the moment you use an outside screening company. If your HR team runs its own Google search on a candidate, the FCRA does not apply. The moment you pay a consumer reporting agency to compile that information, the entire federal compliance framework — standalone disclosures, written consent, the two-step adverse action process, and disposal rules — comes with it. Because almost every employer uses a third-party screener, almost every employer needs a policy built to that standard.

Disclosure and Written Consent

Before ordering any screening report, you have to give the candidate a written document disclosing that a consumer report may be obtained for employment purposes, and the candidate has to authorize the report in writing. The statute requires the disclosure to appear in a standalone document — one that “consists solely of the disclosure.”¹ The written authorization can appear on the same form.

The standalone requirement trips up employers constantly. You cannot fold the disclosure into your job application. You cannot tack on a liability waiver, a certification that the applicant’s information is accurate, or a statement that your hiring decisions are nondiscriminatory. The FTC has been explicit that those extras not only make the form harder to understand but may independently violate the FCRA.² If you need additional waivers or acknowledgments, put them in a separate document.

“Employment purposes” under the FCRA covers hiring, promotion, reassignment, and retention decisions, so your disclosure and consent procedures need to apply beyond the initial hire.³

What Categories of Screening to Run

A good policy matches the screening to the role. Running unnecessary checks wastes money and creates legal exposure. The most common categories to define:

Criminal history searches at the county, state, and federal level.
Employment verification of previous titles, dates, and sometimes reasons for departure.
Education verification confirming degrees and attendance.
Motor vehicle records for any role involving a company vehicle.
Professional license verification for nursing, accounting, law, engineering, and similar credentialed positions.

Credit checks deserve their own treatment. They are governed by the same FCRA disclosure and consent rules, but more than a dozen states now restrict or prohibit employers from pulling credit history for most positions, typically allowing exceptions only for banking, law enforcement, or fiduciary roles. Identify which specific positions justify a credit check in the policy, and confirm the applicable state restriction before running one.

How Far Back a Report Can Reach

The FCRA sets specific time limits on certain adverse information, but those limits do not apply equally to everything. Consumer reporting agencies generally cannot report the following if they are older than seven years: non-conviction arrest records, civil suits and judgments, paid tax liens, accounts placed for collection, and most other adverse information.⁴ Chapter 7 bankruptcy filings can be reported for up to ten years.

Criminal convictions have no federal time limit. A consumer reporting agency can report a conviction regardless of how old it is. Some states impose their own seven-year cap on reporting convictions, but the federal FCRA does not.

There is also a salary exception: none of the seven-year or ten-year limits apply to positions with an expected annual salary of $75,000 or more.⁴ For higher-paying roles, the report can include older arrests, civil judgments, and other adverse items that would otherwise be excluded. A policy should explain this so HR teams know why reports for senior positions may contain more historical information.

The Adverse Action Process

When a screening report turns up information that may lead you to reject a candidate, the FCRA requires a two-step notification process. Skipping or rushing either step is one of the most common ways employers end up in class-action litigation.

Pre-Adverse Action Notice

Before making a final decision, you must send the candidate a pre-adverse action notice. It has to include a copy of the consumer report that influenced the decision and a written summary of the consumer’s rights under the FCRA.¹ The point is to give the candidate a chance to review the report and flag any errors before you act on it.

The statute does not specify how long you must wait. Five business days has become the widely accepted standard, and most employment attorneys recommend at least that much time. Shorter windows invite litigation. Longer ones are fine but slow down hiring. Set a specific internal waiting period in the policy so the process is consistent across all candidates.

Final Adverse Action Notice

If you move forward with the rejection after the waiting period, a second notice is required. It must tell the candidate the decision was based on information in the consumer report; provide the name, address, and phone number of the reporting agency; and state that the agency did not make the hiring decision and cannot explain the reasons behind it.⁵ It must also inform the candidate of their right to dispute the report’s accuracy and to obtain a free copy of the report within 60 days.

When a Candidate Disputes the Report

When a candidate disputes information, the consumer reporting agency generally has 30 days to investigate and five business days after completing the investigation to notify the candidate of the results. If the candidate provides additional relevant information during the initial 30-day window, the agency can extend its investigation by 15 more days. Build this timeline into your policy. If a candidate disputes a report during the pre-adverse action waiting period, pause the hiring decision until the dispute is resolved rather than act on information that may be wrong.

Criminal History and the EEOC

A policy that screens out every candidate with a criminal record creates serious legal risk under Title VII of the Civil Rights Act. The EEOC has warned for years that blanket criminal-history exclusions can produce a disparate impact — disproportionately screening out protected groups — even when the policy looks neutral on its face.⁶ When that happens, you must show the policy is job-related and consistent with business necessity.

The EEOC recommends the three “Green factors” for evaluating whether a particular conviction justifies excluding a candidate:

The nature and gravity of the offense, including how serious the conduct was and the degree of harm.
The time elapsed since the offense or completion of the sentence.
The nature of the job held or sought, and whether the criminal conduct relates to its duties and environment.

The EEOC also emphasizes that you should not rely on arrest records alone to exclude candidates, since an arrest is not proof someone committed a crime. Build in an individualized assessment step, giving the candidate a chance to explain the circumstances, provide evidence of rehabilitation, and demonstrate why the exclusion should not apply.⁶ Skipping this step is where most employers get into trouble, and formalizing it in writing is exactly the kind of safeguard the policy exists to provide.

State and Local Fair-Chance Laws

Roughly 15 states have fair-chance hiring laws that reach private employers. These laws generally prohibit asking about criminal history on the initial job application — the “ban the box” label comes from removing the conviction-history checkbox. Timing varies: some states delay the inquiry until the first interview, others push it to after a conditional job offer.

Several major cities and counties have their own fair-chance ordinances with additional requirements: mandatory written evaluations explaining why a conviction disqualifies a candidate, specific waiting periods for the candidate to respond, and individualized assessments similar to the EEOC’s Green-factor analysis. Some local ordinances authorize six-figure civil penalties for willful violations.

Because the requirements differ significantly across jurisdictions, a national employer needs a policy flexible enough to comply with the strictest applicable rule. The simplest approach for multi-state employers is often to delay criminal history inquiries until after a conditional offer everywhere, even in states that do not require it. That avoids maintaining a separate workflow for every jurisdiction.

Record Retention and Secure Disposal

A policy is incomplete without rules for how long screening records are kept and how they are destroyed. EEOC regulations require employers to retain all personnel and employment records, including background check results, for at least one year. If an employee is involuntarily terminated, records must be kept for one year from the termination date. If a discrimination charge is filed, all related records must be preserved until the charge is fully resolved, including any appeals.⁷

When records are no longer needed, the FTC’s Disposal Rule under 16 CFR Part 682 requires anyone who possesses consumer report information to take reasonable measures to prevent unauthorized access during disposal. Acceptable methods include shredding or pulverizing paper documents so they cannot be reconstructed, destroying or erasing electronic media so the data is unrecoverable, or contracting with a certified record destruction company after conducting due diligence on that company’s practices.⁸ Tossing files in a recycling bin or deleting a folder without overwriting the data does not meet the standard.

Rescreening Current Employees

Many policies focus only on pre-hire screening, but a growing number of employers run periodic or continuous checks on existing employees, particularly in healthcare, financial services, and transportation. The FCRA applies to rescreening the same way it applies to initial screening: you need proper disclosure and written consent before ordering a consumer report on a current employee. Some employers include rescreening authorization in initial onboarding paperwork; others obtain fresh consent for each check. A handful of states require new consent each time. Specify the rescreening cadence — annual, event-triggered, or continuous — and identify which positions are covered, so employees are not surprised when a check runs.

What Noncompliance Costs

Getting the process wrong exposes you to two tiers of liability under the FCRA. Willful noncompliance allows affected individuals to recover statutory damages between $100 and $1,000 per violation, or actual damages if higher, plus punitive damages and attorney fees at the court’s discretion.⁹ Negligent violations carry a lower ceiling: actual damages plus attorney fees, with no statutory minimum and no punitive damages.¹⁰

The per-violation structure is what makes FCRA lawsuits so expensive. A company that includes a liability waiver on its disclosure form, a willful violation of the standalone requirement, may face a class action from every applicant who signed that form. Multiply even the $100 minimum by thousands of applicants and the exposure adds up fast. Courts have repeatedly sided with plaintiffs on these technical failures, particularly around the standalone disclosure rule and the adverse action process. State fair-chance laws and local ordinances layer additional penalties on top, with some jurisdictions authorizing civil fines well into six figures for willful or repeated violations.

1
Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
2
Federal Trade Commission. Background Checks on Prospective Employees: Keep Required Disclosures Simple
3
Office of the Law Revision Counsel. 15 USC 1681a – Definitions; Rules of Construction
4
Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports
5
Federal Trade Commission. Using Consumer Reports: What Employers Need to Know
6
U.S. Equal Employment Opportunity Commission. Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions Under Title VII of the Civil Rights Act
7
U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements
8
eCFR. 16 CFR 682.3 – Proper Disposal of Consumer Information
9
Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
10
Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance