SignLater

Background Checks: The FCRA Sequence

The short answer: Background-check lawsuits are almost never about what you found — they’re about the order you did things in. Federal law (the Fair Credit Reporting Act) requires three steps in exact sequence: (1) before you order the check, give a standalone written disclosure and get written permission; (2) before you reject someone over the results, give them the report plus a rights summary and time to respond; (3) when you reject them, send a formal notice with specific contents. Skip a step and the violation is per-applicant — which is how small procedural mistakes become class actions.

This is the paperwork clock that runs alongside every hire — and the I-9 has its own clock with its own fines. I-9 and E-Verify: First-Hire Paperwork covers the three-day verification deadline.

This guide is educational, not legal advice. It covers the federal FCRA procedure — your state and city may add ban-the-box timing rules on top. Employment law is state-specific; when in doubt, get counsel before you screen.

Step 1: Before you order — disclosure and authorization

Before a background-check company (legally, a “consumer reporting agency”) pulls anything for employment purposes, two things must happen, in this order:

  1. A clear, standalone written disclosure. The law requires “a document that consists solely of the disclosure” — [15 U.S.C. §1681b(b)(2)(A)](https://uscode.house.gov/view.xhtml?req=%28title:15%20section:1681b%20edition:prelim%29, verified October 2026. In plain English: the disclosure that you’re going to run a background check must be its own document. Burying it on page 4 of the job application, in the handbook acknowledgment, or in a wall of onboarding paperwork fails the test — this is the single most litigated FCRA issue in employment, and employers keep losing it.
  2. The applicant’s written authorization. Same statute, same moment — signed permission to obtain the report.

Practical consequence: make a one-page disclosure form. Nothing else on it — no liability waivers, no acknowledgments, no “and also” paragraphs. One page, one purpose, signed and dated.

Step 2: Before you act on bad news — the pre-adverse-action packet

You got the report back and something in it disqualifies the candidate. You may not reject them yet. First, [15 U.S.C. §1681b(b)(3)(A)](https://uscode.house.gov/view.xhtml?req=%28title:15%20section:1681b%20edition:prelim%29 requires you to give the applicant:

  1. A copy of the background report you received, and
  2. A written summary of their rights under the FCRA — the CFPB’s “Summary of Your Rights” (Appendix K, Regulation V, 12 CFR pt. 1022, verified October 2026).

Then you wait. The statute doesn’t name a number of days — the widely followed practice is about five business days, to give the applicant a real chance to dispute errors with the reporting agency. Say this explicitly in your process documents: five business days is custom, not law. What’s legally required is a reasonable opportunity to respond before you decide.

Why this step exists: background reports are wrong more often than you’d think — mixed files, expunged records that didn’t get expunged, same-name mismatches. The law gives the applicant a chance to catch the error before it costs them the job.

Step 3: The adverse action notice

If, after the waiting period, you still won’t hire them because of the report, 15 U.S.C. §1681m(a) requires a formal adverse action notice containing:

  • Notice that the adverse action was taken based wholly or partly on the report;
  • The reporting agency’s name, address, and phone number;
  • A statement that the agency didn’t make the hiring decision and can’t explain why it was made;
  • Notice of the right to a free copy of the report within 60 days; and
  • Notice of the right to dispute the report’s accuracy with the agency.

Miss any element and the notice is defective. Keep copies of everything you sent, with dates — if this is ever questioned, the paper trail is the defense.

The EEOC overlay: criminal history needs individual assessment

Separate from the FCRA’s procedure, the EEOC’s 2012 Enforcement Guidance on criminal-history screening says blanket bans (“no felons, ever”) risk disparate-impact liability — because criminal-history rates differ sharply by race and national origin, an inflexible screen can function as discrimination even without discriminatory intent. The guidance calls for an individualized assessment: the nature and gravity of the offense, the time passed, and the nature of the job.

What that means in practice: a theft conviction from last year for a cashier applicant is a different decision than a decade-old offense for a warehouse role — and your process should show you actually made that distinction, in writing, per applicant.

Ban-the-box: when you can ask

A growing number of states and cities have “ban-the-box” laws that delay when in the process you may ask about criminal history — typically not until after a conditional offer or an interview. The roster changes constantly (new city ordinances appear every year), so this guide won’t give you a list that goes stale:

  • The concept: you can still run the check; you just can’t ask about criminal history on the initial application.
  • Examples of the pattern: these laws exist in many states and dozens of cities — the specifics (timing, exceptions, penalties) differ everywhere.
  • What to do: check your state attorney general’s office and your city’s rules before you put together the application packet. If you hire in multiple jurisdictions, the strictest timing rule you face governs your process.

What this guide deliberately doesn’t tell you

It doesn’t tell you what to screen for — which offenses disqualify which roles, how to weigh a DUI for a driving job, whether to run credit checks. Those are judgment calls with legal consequences, and they’re your employment lawyer’s job. This guide covers the procedure — the sequence the federal government requires regardless of what you decide to screen for. Get the procedure right every time; get advice on the substance case by case.

Methodology

This is a procedure guide, not a numbers guide — there are no worked calculations because the expensive mistakes here are sequencing errors, each carrying per-violation statutory exposure. Every step is cited to the FCRA section that requires it, with section URLs verified on uscode.house.gov in October 2026. The “five business days” waiting period is explicitly flagged as industry custom, not statutory text. State ban-the-box laws are deliberately not catalogued (they change too fast for a static list); the guide routes readers to their state AG. This page is educational, not legal advice.

Sources

  • 15 U.S.C. §1681b(b)(2)(A) — standalone disclosure + written authorization — [uscode.house.gov](https://uscode.house.gov/view.xhtml?req=%28title:15%20section:1681b%20edition:prelim%29, verified October 2026
  • 15 U.S.C. §1681b(b)(3)(A) — pre-adverse-action report copy + rights summary — [uscode.house.gov](https://uscode.house.gov/view.xhtml?req=%28title:15%20section:1681b%20edition:prelim%29, verified October 2026
  • 15 U.S.C. §1681m(a) — adverse action notice contents — uscode.house.gov, verified October 2026 (URL official-domain confirmed; page render not re-verified in-session)
  • CFPB Summary of Rights Under the FCRA, Appendix K to 12 CFR Part 1022 — consumerfinance.gov, verified October 2026
  • FTC/EEOC joint employer guidance, “Background Checks: What Employers Need to Know” — ftc.gov, verified October 2026
  • EEOC 2012 Enforcement Guidance on criminal history — eeoc.gov (individualized assessment; confirmed still operative October 2026)

Frequently asked questions

Does the FCRA apply if I just Google the applicant? The FCRA covers reports from consumer reporting agencies — not your own internet searching. But state laws and the EEOC’s discrimination rules still apply to whatever you find and use. “I found it online” is not a defense to a discrimination claim.

Can I use one disclosure form for background checks and drug tests? The background-check disclosure must stand alone under §1681b(b)(2)(A). Put the drug-test consent on a separate document. Combining them is exactly the kind of bundling courts have struck down.

What if the applicant never responds to the pre-adverse-action packet? Document the sent date, wait the reasonable period (the five-business-day custom), then proceed to the adverse action notice. The obligation is to give them the opportunity — not to get a reply.

Do I need to do all this for a nanny or household employee? The FCRA applies to employment-purpose reports generally, including household employment. The practical guidance from the FTC/EEOC joint publication covers employers broadly — when in doubt, follow the sequence.

My background-check vendor says they “handle compliance.” Do they? The vendor handles their compliance (accuracy procedures, reinvestigations). The three-step employer sequence above — disclosure, pre-adverse action, adverse action notice — is your legal obligation. No vendor contract transfers it.