Employer background check rules: the FCRA hiring steps

Your hardware store has a candidate you like, and a screening company's order form is open. Employer background check rules decide what happens before you click order and after the report arrives. A background check for hiring is a report on a person's records, such as criminal history or credit, used in a job decision. What follows explains the law; it is not legal advice. For a real applicant, talk to an employment attorney, the EEOC or your state's civil rights agency.

We follow seven made-up applicant files for a made-up 22-person store. The steps run from what the FCRA requires, the disclosure and signature, and searching a candidate online yourself to what a report may include. Arrest and conviction records under EEOC guidance come before the pre-adverse notice. Fair chance laws in California and Washington, our timeline test, the adverse action notice, and keeping and shredding the file close it out.

What does the FCRA require before you order a background check?

The FCRA starts to apply the moment a screening company compiles the report for you, which is where the joint EEOC and FTC page for employers draws the line. Buying checks "through a company in the business of compiling background information" brings in the Fair Credit Reporting Act, and its examples include "a credit or criminal background report." The law calls that product a consumer report, and under 15 U.S.C. 1681a it covers information on a person's "character, general reputation, personal characteristics, or mode of living."

It isn't only about new hires. The same section covers reports for "employment, promotion, reassignment or retention," so a current cashier up for a key-holder job gets the same steps. Company size? The FCRA's employment rules name no minimum, though size matters for the discrimination laws covered with the EEOC guidance. The FTC's guide Using Consumer Reports: What Employers Need to Know lays out the same duties for employers. You'll give a disclosure, get written consent and certify to the screening company, and if the report hurts the applicant's chances, you also send two notices.

The disclosure and the signature: one page or two?

Homemade hiring paperwork usually breaks at the disclosure, since the wording in 15 U.S.C. 1681b(b)(2)(A) is narrow. The disclosure must be "clear and conspicuous" and in writing. It's got to reach the applicant before you order the report. And it must sit "in a document that consists solely of the disclosure." The joint page says it more plainly: "The notice can't be in an employment application."

Your signature line can share that page. The statute lets the written authorization "be made on the document" that holds the disclosure, so one sheet with both is fine.

The joint page allows "some minor additional information," like a line on what consumer reports are. It's allowed "only if it doesn't confuse or detract from the notice." Application questions and policy sign-offs go on other pages. With the signed page in hand, you certify to the screening company. Section 1681b(b)(1) has you confirm three things: you gave the disclosure, you'll follow the notice steps, and you won't use the report against equal employment law. If the company will also interview references or neighbors about character, that's an investigative consumer report. 15 U.S.C. 1681d then requires a written notice "not later than three days" after the report is first requested.

Online applications follow the same rule, so the disclosure needs its own screen. Our guide to building an HTML form that delivers its entries covers the form side of a careers page. Our web developers can build the flow with the disclosure as its own step.

Put your business name and the screening company's name on the disclosure page. The adverse action notice must later give that company's "name, address, and telephone number," so the applicant meets the same name twice.

Applicants who've read warnings like our post on spotting fake work-from-home job offers look for exactly that before they sign.

Searching a candidate online yourself

Not every check goes through a company. When you're the one searching an applicant's name, there's no consumer reporting agency involved.

Section 1681a(f) defines one as a business that assembles information "for monetary fees" and furnishes reports to others, but your own search still isn't free of rules. The joint page says the anti-discrimination laws apply to background information "regardless of how you got the information."

That matters online, because a public profile can show a religion, a disability or an age. The joint page lists race, color, national origin, sex, religion, disability, genetic information and age (40 or older).

It also says "asking only people of a certain race about their financial histories or criminal records is evidence of discrimination." Its first rule is to treat everyone equally, which for an online search means running the same search at the same stage for every finalist.

California goes further. The Civil Rights Department's Fair Chance Act fact sheet (June 2025) says most employers there can't "do an Internet search for criminal history before making a job offer."

An applicant's Social Security number isn't a search key, either. Our explainer on why a free people search by Social Security number fails covers who may lawfully pull a report on someone.

What a background report may and may not include

When the report arrives, some gaps are there by law. Under 15 U.S.C. 1681c(a), a screening company can't report "records of arrest" more than seven years old. The limit runs longer when the statute of limitations does, and most other negative items older than seven years drop off as well. Convictions are the exception, since the text excludes "records of convictions of crimes" from that limit. So under federal law, a conviction can show up at any age. The CFPB's A Summary of Your Rights Under the Fair Credit Reporting Act gives consumers the general rule: old negative information usually can't be reported.

Better-paid jobs work differently. As of October 2026, 1681c(b)(3) lifts the seven-year limits for a job whose salary may "reasonably be expected to equal $75,000, or more."

For a $38,000 store job like the one in our made-up files, the limits apply in full. State law can cut deeper. California's fact sheet lists "Conviction history that is more than seven years old" among the things an employer there can never use in a decision.

Arrest and conviction records under EEOC guidance

The EEOC's main rules start at 15 workers. Its small business requirements page puts a business with 15 to 19 employees under the laws on race, color, religion, sex, national origin, disability and genetic information.

Title VII's definition of employer uses the same number, "fifteen or more employees." Age rules start at 20 employees. The EEOC page puts a business with "at least one employee" under the equal pay law.

For criminal records, the EEOC's 2012 Enforcement Guidance on arrest and conviction records splits arrests from convictions. "The fact of an arrest does not establish that criminal conduct has occurred," it says. Excluding someone for an arrest alone "is not job related and consistent with business necessity." Convictions aren't the same. "A conviction record will usually serve as sufficient evidence that a person engaged in particular conduct." The conduct behind an arrest can still count, the guidance adds, if it makes the person unfit for the job.

Even then, three factors from a 1977 court case come first: "the nature of the crime, the time elapsed, and the nature of the job." A screen built on those then "provides an opportunity for an individualized assessment." The guidance says Title VII "does not necessarily require individualized assessment in all circumstances," but the step can help an employer avoid liability. In the guidance, that means telling the person they may be excluded and giving them a chance to show the exclusion shouldn't apply. You'll then weigh what they send before you decide.

Two points in the guidance aren't rules, just advice. It recommends that employers "not ask about convictions on job applications." Its header also says the contents "do not have the force and effect of law."

Even so, the joint page warns against record screens that don't "accurately predict who will be a responsible, reliable, or safe employee." California and Washington wrote the application point into state law.

Before you say no: the pre-adverse action notice

If anything in the report could turn a yes into a no, a notice comes before the decision. Section 1681b(b)(3)(A) covers action based "in whole or in part on the report." Before you take it, you've got to give the person "(i) a copy of the report; and (ii) a description in writing of the rights of the consumer." Adverse action, under 1681a(k), includes "a denial of employment." A withdrawn offer counts.

That description of rights isn't free-form; it's a set form. The joint page says you "should have received" it from the company that sold you the report.

The CFPB publishes the model, and Appendix K to Regulation V asks for a version "substantially similar to the Bureau's model summary." Attach the copy that came with this applicant's report. Then comes the wait, and federal law gives no number for it. The joint page explains why the notice comes early: "the person has an opportunity to review the report and explain any negative information." Neither that page, the statute nor the FTC guide sets a count of days. In our test, file F waited 7 calendar days between its two notices and passed the federal order check, because there's no federal day count to miss.

Fair chance laws in California and Washington

Many states and cities add their own layer. We name only two, from each state's own pages, because their day counts change the timeline; anywhere else, check your state's labor or civil rights agency.

California's Fair Chance Act has been in effect since January 1, 2018. The Civil Rights Department says it covers public employers and private employers "that have five or more employees." Before an offer, most can't ask about conviction history or run a criminal background check, and job ads can't say "No Felons." After a conditional offer a check is allowed, but arrests without a conviction stay off limits, with limited exceptions, and so do convictions more than seven years old. Those seven years count from the conviction, release or parole date.

Withdrawing an offer there takes two notices. The preliminary one lists the convictions, includes the report and explains the right to respond.

The CRD fact sheet sets the deadline at "at least five business days from the date the notice is received." It's "at least ten days if the job seeker is challenging the accuracy of the background check." Mail to a California address counts as received five calendar days after it goes out. The final notice, in writing, names any appeal process and the right to complain to the CRD.

Washington's Attorney General page on the Fair Chance Act bars criminal record questions on applications, along with any criminal history check before a conditional offer. Before turning someone down over a record, the employer has to name the record. Then, in the words of RCW 49.94.010, it must "hold open the position for a minimum of two business days." A rejection also needs a written decision. Per the AGO page, it documents the employer's reasoning and its look at the person's rehabilitation, good conduct, work experience, education and training. The page says amendments apply from July 1, 2026, at 15 or more employees and from January 1, 2027, below that. The three sets of rules, as of October 2026:

Our test files show how California's receipt rule moves the dates: in made-up file C, a notice was mailed to a California address on Tuesday, October 13. It counted as received on Sunday, October 18, so the reply window ran through Friday, October 23, and a decision on October 20 came too early. File D's notice went by email with receipt confirmed October 14, its window closed October 21, and an October 23 decision was on time. Washington file E was turned down on October 15, but the hold didn't end until October 16.

What we tested

On October 30, 2026, we ran a Python checker on the seven made-up Ellisford Hardware files, with up to nine checks each:

1. disclosure on its own page
2. consent before the order
3. certification given
4. pre-adverse notice sent first
5. state wait (CA or WA)
6. four adverse notice items
7. arrest-only decision (flag)
8. keep-until date
9. report after the offer (CA or WA)

A and D came back clean. B failed check 1, with its disclosure inside the application, and G failed check 2: report ordered October 2, consent signed October 5. C and E failed the state wait. F failed check 6 with 3 of 4 items and drew the only flag, for an arrest-only decision. The checker skips weekends, not holidays.

The adverse action notice and its four items

Once the decision is final, a second notice goes out, and 15 U.S.C. 1681m(a) sets what it says. It can be oral, written or electronic. It must give the applicant these four things:

• the "name, address, and telephone number" of the screening company that furnished the report
• a statement that the company "did not make the decision" and can't give the specific reasons
• notice of the right to a free copy of the report, with "the 60-day period" for asking
• notice of the right to dispute "the accuracy or completeness" of the report

The joint EEOC and FTC page lists the same four points and adds that the person was rejected "because of information in the report." If a numerical credit score played a part, 1681m(a)(2) also has you disclose that score. File F in our test got the first notice right and still failed here, because its adverse notice left out the 60-day line. If screening software sends your notices, compare its dates and contents with these lists; our piece on automating pre-employment screening covers what those tools do.

Keeping and shredding the file

After the last notice, the file isn't done. Under 29 CFR 1602.14, an employer covered by the EEOC's rules keeps hiring records for one year. The clock starts at "the making of the record or the personnel action involved, whichever occurs later." The joint page adds that a discrimination charge extends that until the case ends. In our test, keep-until dates ran from October 5, 2027, for G to October 23, 2027, for D. When the year is up, the FTC's Disposal Rule, 16 CFR 682.3, requires "reasonable measures to protect against unauthorized access." The joint page's examples are "burning, pulverizing, or shredding paper documents," and electronic files must be wiped so they "can't be read or reconstructed."

Reports kept in an HR system fall under the same Disposal Rule, so deleting one there has to leave it unreadable, not just hidden from a list. Our guide to choosing HR software covers where records are stored, and our cybersecurity tips to protect your business cover the shared drive where notice copies often end up.

Write the date and delivery method on each notice as it goes out, since California counts from receipt and Washington from the notice. When a file turns on a conviction or a state rule, it's worth calling an employment attorney before the final notice goes out.

Other things employers ask

How we made this guide: The steps come from the FCRA's text and EEOC, FTC, CFPB, eCFR and state agency pages. Each federal and Washington rule has a second official source; California's statute site refused our requests, so its rules come from Civil Rights Department pages only. We read the blocked FTC guide through a fetch tool and ran the timeline test on 127.0.0.1. Facts checked by the DigitalTreed team on October 30, 2026.

The April 2025 post at this address covered online background checks for dating, parenting and hiring. This October 30, 2026 rewrite keeps only the hiring part and adds the FCRA steps, the state waits and our timeline test.

Sources

• 15 U.S.C. 1681a: Definitions (govinfo)
• 15 U.S.C. 1681b: Permissible purposes of consumer reports (govinfo)
• 15 U.S.C. 1681c: Information contained in consumer reports (govinfo)
• 15 U.S.C. 1681d: Investigative consumer reports (govinfo)
• 15 U.S.C. 1681m: Requirements on users of consumer reports (govinfo)
• 15 U.S.C. 1681n: Civil liability for willful noncompliance (govinfo)
• 42 U.S.C. 2000e: Title VII definitions (govinfo)
• EEOC and FTC: Background Checks, What Employers Need to Know
• FTC: Using Consumer Reports, What Employers Need to Know
• EEOC: Enforcement Guidance on Arrest and Conviction Records (915.002)
• EEOC: Small Business Requirements
• CFPB: A Summary of Your Rights Under the Fair Credit Reporting Act
• CFPB: Regulation V, Appendix K, Summary of Consumer Rights
• eCFR: 29 CFR 1602.14, Preservation of records
• eCFR: 16 CFR 682.3, Proper disposal of consumer information
• California Civil Rights Department: Fair Chance Act
• California Civil Rights Department: Criminal History and Employment fact sheet (June 2025)
• Washington Attorney General: Fair Chance Act
• Washington Legislature: RCW 49.94.010