Post-Hire Background Checks: FCRA Consent and Adverse Action

Yes, your employer can run post-hire background checks on you, and the Fair Credit Reporting Act treats them almost identically to pre-employment screening. The law defines “employment purposes” to include evaluating a person for “employment, promotion, reassignment or retention as an employee,” which means a consumer report can be pulled at any point in your employment as long as the employer follows the same disclosure, consent, and adverse action rules that apply at hire.¹ If those rules are broken, willful violations expose the employer to statutory damages of $100 to $1,000 per affected employee, plus attorney fees and possible punitive damages.²

Why the FCRA Reaches Current Employees

Most people think of a background check as a hiring gate. The FCRA doesn’t. The single word “retention” in the statute’s definition of employment purposes is what pulls current employees inside the law’s scope.¹ A consumer reporting agency may furnish a report to any person that intends to use the information for employment purposes, and the statute doesn’t distinguish between a first-time applicant and a ten-year veteran.³

The practical result: your employer has the legal ability to pull a fresh report on you. The protections you had as an applicant travel with you.

Common Reasons a Current Employee Gets Checked

A few situations account for most post-hire checks. Promotions are the biggest one, especially when someone moves into a role with financial responsibility. A warehouse worker being promoted to controller has a materially different risk profile, and a fresh credit and criminal check reflects that.

Access changes are the second driver. An employee gaining clearance to work with vulnerable populations, sensitive government data, or proprietary systems typically warrants an updated criminal history search. Employers that operate vehicle fleets often run driving record reviews annually to catch license suspensions and serious violations.

Beyond one-off checks, some employers use rolling monitoring services that flag new arrests, convictions, or license actions in near real-time. These programs have become common in healthcare, financial services, and transportation, where a single missed record can generate serious liability.

Disclosure and Written Consent

Before pulling the report, the employer must give you a written disclosure telling you that a consumer report may be obtained for employment purposes. The FCRA requires this disclosure to appear in a standalone document. It cannot be buried inside an employee handbook, a performance review, or a broader consent form.³ The FTC has said minor additional information, like a brief description of what a consumer report is, can appear on the form, but nothing that distracts from the core notice.⁴

You also have to authorize the report in writing. Many employers use an “evergreen” authorization at hire that is written to cover checks throughout your employment, so they don’t ask for a new signature every time. Courts have generally upheld these blanket authorizations when the original disclosure made clear that ongoing checks were included. Some employers in higher-risk industries still ask for a fresh signature before each check to remove any ambiguity.

The information the screening company usually needs is your full legal name, date of birth, Social Security number, current address, and any previous names or aliases that help match records across jurisdictions.

What Happens if You Refuse

You have the legal right to decline. The FCRA requires written authorization, and no one can be forced to sign.⁵ Refusing a background check, though, is not a protected activity under federal law. In most cases your employer can treat the refusal as grounds for reassignment, denial of a promotion, or termination. Declining a check your employer considers necessary for your role puts you in roughly the same position as refusing any other reasonable job requirement.

Investigative Reports Come With Extra Notice

Standard background checks pull from databases. Some post-hire investigations go further and involve personal interviews with neighbors, coworkers, or other associates about your character, reputation, or lifestyle. The FCRA calls these “investigative consumer reports” and adds requirements on top of the standard disclosure rules.⁶

When your employer orders an investigative report, it has to notify you in writing within three days of requesting it. The notice must explain that the investigation may cover your character, general reputation, personal characteristics, and lifestyle, and must tell you that you have the right to request a complete description of the nature and scope of the investigation. If you ask, the employer has five days to respond in writing.⁶

Employers often miss this because they don’t realize their screening vendor is conducting interviews that trigger the higher standard. If the vendor is calling former supervisors or colleagues, investigative-report rules apply.

The Adverse Action Process

If a post-hire check turns up something the employer wants to act on, the FCRA requires a two-step notice procedure before termination, demotion, or a denied promotion. This is the protection that matters most to you, and skipping either step is one of the most common employer violations.

Step One: Pre-Adverse Action Notice

Before making a final decision, the employer must give you a copy of the report and a written summary of your FCRA rights.³ The point is to give you a chance to see the report and dispute anything inaccurate before the employer acts. The FCRA doesn’t set an exact waiting period, but the widely followed standard is at least five business days, and some employers wait seven.

Step Two: Final Adverse Action Notice

If the employer decides to go forward after the waiting period, it must send a final notice with the name, address, and phone number of the consumer reporting agency that supplied the report. The notice has to tell you that the agency didn’t make the decision and can’t explain it, and that you have the right to dispute the report’s accuracy and to request a free copy within 60 days.⁵

The two-step structure exists so no one loses a job over a background check error without a chance to catch it. In practice, the pre-adverse step is where employer compliance most often breaks down. Some skip it entirely; others send the pre-adverse and final notices on the same day, which defeats the purpose.

Disputing Errors in the Report

If you spot a mistake, the consumer reporting agency that produced the report is required to investigate. The agency generally has 30 days from receiving your dispute to complete its investigation, and that window can be extended by 15 days if you provide new information during the initial 30 days.⁷

During the investigation the agency has to contact the original source of the disputed information and review any documentation you provide. If the information turns out to be inaccurate or unverifiable, it must be deleted or corrected and you must be notified of the result. This is why the pre-adverse action waiting period matters so much. An employee who catches an error in that window can get it corrected before it costs them the job.

What You Can Recover if the Employer Violates the Rules

The FCRA splits violations into willful and negligent, and the consequences differ.

For willful noncompliance, you can recover statutory damages of $100 to $1,000 per violation without proving any actual harm. Punitive damages and attorney fees are also available.² “Willful” isn’t limited to intentional violations. It includes reckless disregard for the law, which is a lower bar than many employers realize.

For negligent noncompliance, you have to prove actual damages, but attorney fees and court costs are still recoverable.⁸ The absence of statutory damages makes individual negligent-violation cases harder to bring on their own, but they still drive class actions when a violation affects hundreds or thousands of employees.

How Criminal Records Can Be Used

Even when a background check is run correctly under the FCRA, Title VII of the Civil Rights Act adds a separate layer of protection. A criminal record policy applied uniformly can still be illegal discrimination if it disproportionately excludes people of a particular race or national origin.⁹

To defend a criminal-record exclusion, an employer has to show it is job-related and consistent with business necessity for the specific position. The EEOC’s guidance uses three factors, called the Green factors:

The nature and gravity of the offense. A fraud conviction weighs differently for a finance role than a warehouse position.
The time that has passed since the offense or the completion of the sentence.
The nature of the job and whether the criminal conduct creates a genuine risk in that specific role.

The EEOC expects an individualized assessment rather than a blanket exclusion. That means giving you a chance to explain the circumstances, considering rehabilitation and employment history, and making a decision tied to you and the position.¹⁰ An arrest record on its own, without evidence that the underlying conduct actually occurred, is not enough to disqualify someone.

State and Industry Rules Can Add Protections

Federal law is the floor. Roughly a dozen states restrict employers from using credit reports in employment decisions unless the position involves specific financial responsibilities, and the details vary. Some require a direct connection between the job duties and the information in the credit report; others carve out exceptions for roles with access to financial assets above certain thresholds.

Several states and major cities also limit when and how criminal records can be considered, going beyond the EEOC’s guidance. These local laws can affect the timing of post-hire checks, the offenses that can be considered, and how far back an employer can look.

In regulated industries, post-hire screening can be mandatory rather than optional. Financial services firms registered with FINRA must keep employee disclosures current through Form U4 amendments, filed within 30 calendar days of learning about new criminal charges, civil judgments, customer complaints, or regulatory actions.¹¹ The Department of Transportation requires ongoing random drug and alcohol testing for safety-sensitive positions under 49 CFR Part 40, and healthcare, school, and childcare employers face their own screening mandates that vary by jurisdiction.

1
Office of the Law Revision Counsel. 15 USC 1681a – Definitions; Rules of Construction
2
Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
3
Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
4
Federal Trade Commission. Using Consumer Reports: What Employers Need to Know
5
Federal Trade Commission. Employer Background Checks and Your Rights
6
Office of the Law Revision Counsel. 15 USC 1681d – Disclosure of Investigative Consumer Reports
7
Federal Register. Supervisory Highlights Consumer Reporting Special Edition, Issue 20, Fall 2019
8
Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance
9
U.S. Equal Employment Opportunity Commission. Questions and Answers About the EEOCs Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions Under Title VII
10
U.S. Equal Employment Opportunity Commission. Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions Under Title VII
11
FINRA. Regulatory Notice 15-05