Background Checks on Employees: FCRA, Title VII, and Ban-the-Box

Federal law lets you run a background check on a job candidate, but only if you follow a specific sequence: give the candidate a standalone written disclosure, get their written authorization, use a legitimate consumer reporting agency, and if anything in the report makes you want to reject them, send a pre-adverse action notice with the report attached before you send the final rejection. Those are the core FCRA background check requirements for employers, and missing any one of them exposes you to statutory damages, punitive damages, and attorney’s fees. The mistakes that generate class actions are almost always in the details.

When the FCRA Applies to Your Hiring

The Fair Credit Reporting Act, at 15 U.S.C. § 1681 and following, governs any employment screen you run through an outside company.¹ That outside company is a “consumer reporting agency,” and what it produces is a “consumer report.” Every rule below flows from that setup.

If your HR team does its own Googling or picks up the phone and calls references directly, without paying a third party, the FCRA technically does not reach that activity. Other laws still might, including Title VII and state-level restrictions on what you can ask about, so treat the FCRA as a floor, not a ceiling.

Disclosure and Written Authorization

Before you order the report, you owe the candidate two things: a clear written disclosure that a background check may be obtained, and a written authorization signed by the candidate.¹

The disclosure has to be “clear and conspicuous” and must live in a document that contains nothing else. Not stapled to a job application. Not tucked inside an employment agreement. Not paired with a liability waiver. The FTC has told employers directly not to load extra language, waivers, or authorizations into this document.² The authorization signature can go on the same standalone page as the disclosure, but the two together still cannot be combined with any other paperwork.

Defective disclosure forms are one of the most litigated FCRA issues. If you inherited a form that mixes the disclosure with a release or an at-will acknowledgment, replace it before your next hire.

Investigative Consumer Reports Add Two Steps

If the screening involves personal interviews about a candidate’s character, reputation, or lifestyle, it counts as an “investigative consumer report” and carries extra duties. Within three days of requesting the report, you must give the candidate separate written notice that this kind of investigation may occur. The candidate can then ask you in writing for a description of the nature and scope of the investigation, and you have five days from that request to respond.³

What the Report Can and Can’t Include

The FCRA restricts how far back a reporting agency can reach for negative information. Unless an exception applies, a consumer report cannot include:⁴

Bankruptcies more than 10 years old from the filing date.
Civil suits and judgments more than seven years old, or older than the applicable statute of limitations, whichever is longer.
Arrest records more than seven years old from the date of arrest.
Collection accounts and charged-off debts more than seven years past the date placed for collection.
Other adverse information more than seven years old, except criminal convictions, which have no federal time limit.

A large exception cuts against candidates for higher-paying jobs. None of these time limits apply when the report is used for a position with an annual salary of $75,000 or more.⁴ Above that threshold, older records are fair game. Several states impose stricter reporting windows that override the federal rule, so the actual lookback depends on where the candidate lives and what the role pays.

You also certify to the reporting agency, as part of ordering any report, that you will not use it in violation of federal or state equal employment opportunity law.¹ That certification is not a formality; it links your FCRA use to your Title VII exposure.

The Adverse Action Process

If something in the report makes you consider passing on the candidate, you cannot just send a rejection letter. The FCRA requires a two-step process, and skipping or collapsing the steps is a routine class-action trigger.

Step One: Pre-Adverse Action Notice

Before you make a final decision, send the candidate a pre-adverse action notice that includes a complete copy of the background report and the CFPB’s document titled “A Summary of Your Rights Under the Fair Credit Reporting Act.”⁵ The purpose is to let the candidate see exactly what you saw and respond, whether with context, evidence of rehabilitation, or a claim that the record belongs to someone else.

The FCRA does not specify a waiting period. The FTC has recommended waiting at least five business days, and most employment lawyers treat that as the practical minimum. Document the date you sent the notice, and do not fill the position during the window.

The waiting period also matters because of how disputes work. A candidate can challenge the accuracy of the report directly with the reporting agency, which then has 30 days to reinvestigate (with up to 15 more if the candidate submits additional information mid-review).⁶ Mistaken identity, an expunged record that resurfaced, or a conviction attached to someone with a similar name are all real scenarios; the waiting period is what lets them surface before you make an irreversible decision.

Step Two: Final Adverse Action Notice

If you go forward with the rejection, send a final adverse action notice that includes:⁷

The reporting agency’s name, address, and phone number, with a toll-free number if the agency operates nationally.
A statement that the reporting agency did not make the hiring decision and cannot explain it.
Notice that the candidate can obtain a free additional copy of the report from the agency within 60 days.
Notice of the candidate’s right to dispute the accuracy or completeness of the report with the agency.

Combining the pre-adverse and final notices into one document defeats the purpose of the waiting period and is itself a violation. Send them separately.

Title VII Sits on Top of the FCRA

Complying with the FCRA is not the same as complying with anti-discrimination law. The EEOC has issued detailed guidance on how criminal history screens can produce illegal disparate impact even when the policy looks neutral.⁸

A blanket “no felonies” rule will disproportionately exclude candidates by race and national origin, and that is enough to violate Title VII unless you can show the policy is job-related and consistent with business necessity. A flat ban almost never survives that test.

The Three Factors to Weigh

The EEOC directs employers to weigh three factors before rejecting a candidate based on a conviction:

The nature and gravity of the offense. A fraud conviction matters more for a bookkeeper than for a warehouse worker.
How much time has passed. A decade-old conviction with no repeat offenses is a different risk profile than a recent one.
The nature of the job, including duties, work environment, and access to vulnerable people or sensitive assets.

The EEOC also recommends giving screened-out candidates a chance to explain their circumstances and present evidence of rehabilitation before you finalize the rejection.⁸ The pre-adverse action window is a natural place to build that in.

Arrests Are Not Convictions

An arrest by itself does not show the person did anything. The EEOC’s position is that rejecting a candidate based solely on an arrest record is not job-related and fails the business necessity standard. You can consider the underlying conduct if it is relevant to the job. A conviction is generally sufficient evidence of the conduct, though the three factors still control whether the conviction justifies rejection.

Ban-the-Box and Fair Chance Laws

Around 37 states and more than 150 cities and counties have enacted “ban-the-box” or fair chance hiring laws that restrict when in the hiring process you can ask about criminal history. The common structure pushes the question until after a conditional offer. About 15 states extend these rules to private employers, not just public ones, and some local ordinances go further.

The specifics vary widely. Some laws only cover public-sector jobs, some cover private employers above a size threshold, and some regulate how you may use conviction information even after you obtain it. If you hire across multiple locations, the strictest applicable law controls each hire.

Keeping and Destroying the Records

Under federal recordkeeping rules, private employers must retain personnel and employment records, including background check documents and applications, for at least one year from the date the record was made or the date of the personnel action, whichever is later. For involuntary terminations, keep the records one year from the termination date. Educational institutions and state and local government employers have a two-year requirement.⁹ If a discrimination charge is filed, hold everything related to that charge until the matter is fully resolved.

When you finally dispose of consumer report information, the FTC’s Disposal Rule kicks in. You have to take reasonable steps to prevent unauthorized access.¹⁰ For paper, that means burning, pulverizing, or shredding so the information cannot be read or reconstructed. For electronic media, it means destruction or erasure so data cannot be recovered. If you use a document destruction vendor, the rule requires a contract specifying compliant disposal, and you must monitor the vendor’s performance.

What Noncompliance Costs

The FCRA splits liability into willful and negligent violations. For willful violations, a candidate can recover actual damages or statutory damages between $100 and $1,000, plus punitive damages in whatever amount the court considers appropriate, plus attorney’s fees and court costs.¹¹ The statutory and punitive figures are per violation, which is how a defective disclosure form or a routine missed pre-adverse action notice produces class-wide judgments in the millions even when the per-person harm looks small.

Negligent violations are limited to the candidate’s actual damages, plus attorney’s fees. The practical difference: willful violations do not require any proof of financial harm, while negligent violations do. And because you certified you would not use the report in violation of equal employment opportunity law, a discriminatory rejection can layer Title VII liability on top of anything the FCRA already covers.

1
Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
2
Federal Trade Commission. Background Checks on Prospective Employees: Keep Required Disclosures Simple
3
Office of the Law Revision Counsel. 15 USC 1681d – Disclosure of Investigative Consumer Reports
4
Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports
5
Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act
6
Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy
7
Office of the Law Revision Counsel. 15 USC 1681m – Duties of Users Taking Adverse Actions on the Basis of Information Contained in Consumer Reports
8
U.S. Equal Employment Opportunity Commission. Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions Under Title VII
9
U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602
10
eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information and Records
11
Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance