FCRA and EEOC Background Check Compliance: The Employer Process in 2026

Most background screening programmes are bought on price and turnaround, then fail on process.

The failure is rarely the check itself. It is the paperwork around it: a disclosure form with a liability waiver stapled to it, an adverse action decision made the same afternoon the report arrived, a blanket rule that excludes anyone with a conviction.

Two separate regimes apply, and conflating them is the single most common mistake. The Fair Credit Reporting Act governs how you obtain and act on a report. Equal Employment Opportunity Commission guidance, under Title VII, governs how you use what it says.

A programme can be perfectly FCRA-compliant and still produce discriminatory outcomes. It can also apply thoughtful individualised assessment and still breach the FCRA on a procedural technicality.

This article is general information, not legal advice. Background screening law varies by state and city, changes frequently, and turns on specifics. Have counsel review your actual process and documents before you rely on them.

Two regimes, two different questions

	FCRA	EEOC guidance, Title VII
Governs	Process of obtaining and acting on a report	Use of the information in hiring decisions
Core question	Did you follow the steps?	Is the outcome discriminatory?
Typical failure	Defective disclosure form	Blanket exclusion rule
Fix	Correct documents and sequence	Individualised assessment

You need both. Vendors help substantially with the first and almost not at all with the second, because the second requires judgement about your specific roles.

The FCRA sequence, step by step

1. Standalone written disclosure

Before obtaining a consumer report, you must tell the candidate in writing that one may be obtained for employment purposes.

The requirement that catches employers out is that the disclosure must be a standalone document. It cannot be buried in an employment application, and it cannot carry unrelated material alongside it.

The most common defect is including a liability waiver or release in the same document. Adding a clause releasing you from claims arising out of the report is precisely the kind of extra language that defeats the standalone requirement.

This provision generates a substantial share of screening litigation, and the reason is instructive: the violation is purely technical. It does not require the candidate to have suffered any harm, or even for the report to contain anything adverse. The form is either compliant or it is not.

If you review one document this quarter, review this one.

2. Written authorisation

You need the candidate’s written permission before obtaining the report. In practice this often sits alongside the disclosure, and the two are frequently discussed together, but they are distinct requirements.

Electronic authorisation is generally acceptable, which is why screening vendors integrate with applicant tracking systems to capture it in the candidate flow. If you are sequencing those two rollouts, our ATS implementation guide covers the order of operations.

3. Certification to the screening vendor

You certify to the consumer reporting agency that you have made the required disclosure, obtained authorisation, and will comply with the adverse action process and applicable equal opportunity law.

This is usually handled once in the vendor contract rather than per check. It is also why your vendor cares about your process: they have taken your certification at face value.

4. Pre-adverse action notice

If the report might cause you to take adverse action, such as withdrawing an offer, you must act before you decide, not after.

The pre-adverse action step has three components:

• A written notice that you are considering adverse action based on the report
• A copy of the consumer report itself
• A copy of the Summary of Your Rights Under the Fair Credit Reporting Act

All three. Sending the notice without the report is a frequent and avoidable error.

5. A reasonable waiting period

After the pre-adverse action notice you must give the candidate a reasonable opportunity to review the report and dispute anything inaccurate.

The statute does not fix a specific number of days. Five business days is the commonly used convention, and many employers adopt it precisely because no bright line exists. Shorter periods are harder to defend; longer ones cost you time to hire.

The point of the waiting period is substantive, not ceremonial. Consumer reports do contain errors, including mismatched identities on common names. The dispute window is the mechanism that catches them before someone loses a job over a record that is not theirs.

Treating it as a formality and making the decision internally during the waiting period defeats the purpose and is difficult to defend if challenged.

6. Adverse action notice

If you proceed after the waiting period, you send a final adverse action notice. It generally identifies the consumer reporting agency, states that the agency did not make the decision and cannot explain it, and informs the candidate of their rights to a free copy of the report and to dispute its accuracy.

Who does what: you or the vendor

Screening platforms increasingly automate the adverse action workflow. That is genuinely useful and it does not transfer the obligation.

Step	Commonly automated	Remains yours
Disclosure and authorisation capture	Yes, via ATS integration	Document wording
Pre-adverse action notice and report copy	Yes	Decision to initiate
Waiting period tracking	Often	Not deciding during it
Adverse action notice	Yes	The decision itself
Individualised assessment	No	Entirely yours

This is why question five in our background check software comparison asks who issues the notices. Vendors differ, and the answer changes how much process you have to build yourself.

What no vendor can do is the individualised assessment, because it requires knowledge of the role.

The EEOC layer: using the result lawfully

A fully compliant FCRA process can still produce unlawful outcomes under Title VII.

The concern is disparate impact. A facially neutral rule — excluding anyone with a criminal record — can fall more heavily on groups protected under Title VII, given documented disparities in arrest and conviction rates. A rule need not be intentionally discriminatory to create liability.

The Green factors

EEOC guidance directs employers to weigh three factors rather than applying a blanket rule:

1. The nature and gravity of the offence. A violent felony and a decade-old misdemeanour are not equivalent inputs.
2. The time elapsed since the offence or the completion of a sentence.
3. The nature of the job held or sought, and whether the record relates to its actual duties.

The third factor does most of the work. A conviction for financial fraud is plainly relevant to a role with payment authority and considerably less so to a warehouse position. Relevance has to be assessed against the specific job, which is why blanket policies are hard to defend.

Individualised assessment

Where a record would otherwise disqualify a candidate, EEOC guidance calls for an individualised assessment: tell the candidate they may be excluded because of the record, give them a chance to explain, and consider what they provide.

Relevant context might include the circumstances of the offence, the accuracy of the record, rehabilitation, employment history since, and whether the conduct relates to the role.

In practice this folds naturally into the FCRA waiting period. The candidate already has the report and an opportunity to respond. Using that window for both purposes is efficient and produces a documented record of the assessment.

Document the reasoning in both directions. A written note of why a record was or was not disqualifying for a specific role is the evidence that a judgement was made rather than a rule applied.

The state and city layer

Federal requirements are the floor. A substantial body of state and municipal law sits on top, and it varies considerably.

Common variations include:

• Ban-the-box laws, restricting when in the hiring process you may ask about criminal history. Many defer the question until after a conditional offer.
• Fair chance ordinances, which can impose their own assessment and notice requirements beyond the federal ones, sometimes with specific timelines.
• Lookback limits, restricting how far back reportable information may go, with variations by state and by salary threshold.
• Restrictions on specific categories, such as salary history, credit information, or arrests that did not lead to conviction.

If you hire in multiple jurisdictions, the practical consequence is that a single national screening policy applied uniformly is likely to be either non-compliant somewhere or more restrictive than necessary everywhere.

Most organisations resolve this by setting the policy to the strictest applicable standard, or by configuring the process per jurisdiction in the applicant tracking system. The first is simpler; the second preserves more hiring flexibility.

Building a defensible process

A workable programme usually has six parts:

1. A reviewed standalone disclosure document. Nothing in it but the disclosure. No waiver, no release, no extra policy text. Reviewed by counsel, version-controlled.

2. A written screening policy tied to roles. Which checks run for which role types, and why each is relevant to that role’s duties. This is the document that demonstrates job-relatedness.

3. A defined waiting period. Pick a period, commonly five business days, write it down, and apply it consistently. Inconsistency is itself evidence of a problem.

4. An individualised assessment step with a record. A short structured form capturing the Green factors and anything the candidate provided, completed before the final decision.

5. Jurisdiction mapping. Which rules apply where you hire, reviewed when you enter a new state or city.

6. Clear vendor boundaries. Written confirmation of which steps the vendor performs and which remain yours. Assumed coverage is where gaps appear.

Seven compliance questions for your screening vendor

1. Do you provide template disclosure and authorisation documents, and have they been reviewed by counsel? Templates are a starting point, not a defence. The obligation stays with you.
2. Does the platform send pre-adverse action notices with the report and the Summary of Rights attached automatically? All three components, not just the notice.
3. Is the waiting period configurable and enforced? Can the system prevent a final decision being recorded before it elapses?
4. Does the platform support jurisdiction-specific workflows? Ban-the-box timing and fair chance requirements differ by location.
5. How are disputes handled, and what is the turnaround? A dispute pauses your hire. The resolution service level is a hiring metric, not just a compliance one.
6. What audit trail is retained, and for how long? If challenged, you need to show what was sent, when, and what was considered.
7. How is the individualised assessment supported? Most platforms will not perform it. Ask whether there is at least a structured place to record it.

Where compliance meets cost

Compliance has a budget dimension that rarely appears in a vendor comparison.

A defined waiting period adds time to hire. If you run a five-business-day window, every screened hire carries roughly a week of process after the report returns, regardless of how fast the check itself was. A vendor advertising same-day turnaround does not shorten that week.

That has a procurement implication. Paying a premium for marginally faster checks may buy you very little if your own waiting period dominates the timeline. Our comparison of screening vendor pricing found that published per-check rates vary from $29.99 upward, and the compliance window is frequently the larger constraint on time to hire.

Disputes extend it further, which makes dispute resolution service levels worth negotiating.

Frequently asked questions

What is a standalone disclosure under the FCRA?

A written notice to the candidate that a consumer report may be obtained for employment purposes, in a document containing only that disclosure. It must not be combined with an employment application or carry unrelated material such as liability waivers or releases. Defective disclosure documents are among the most frequently litigated FCRA issues.

How long must employers wait after a pre-adverse action notice?

The FCRA requires a reasonable opportunity for the candidate to review the report and dispute inaccuracies, without specifying a fixed number of days. Five business days is the convention many employers adopt. Define a period, document it, and apply it consistently.

What must a pre-adverse action notice include?

Three things: written notice that adverse action is being considered based on the report, a copy of the consumer report itself, and a copy of the Summary of Your Rights Under the Fair Credit Reporting Act. Omitting the report copy is a common error.

What are the Green factors?

The three considerations in EEOC guidance for assessing criminal records in hiring: the nature and gravity of the offence, the time that has passed since it, and the relationship between the record and the duties of the job in question. They exist to replace blanket exclusion rules with a role-specific judgement.

Can we automatically reject anyone with a criminal record?

A blanket exclusion is difficult to defend. Because arrest and conviction rates differ across groups protected under Title VII, a facially neutral rule can create disparate impact without any discriminatory intent. EEOC guidance directs employers to weigh the Green factors and conduct an individualised assessment instead.

Does our screening vendor handle FCRA compliance for us?

Partly. Many platforms automate disclosure capture, pre-adverse action notices and adverse action notices. The legal obligation stays with the employer, and no vendor can perform the individualised assessment, which requires knowledge of the role. Confirm in writing which steps the vendor performs and which remain yours.

Do federal rules cover everything?

No. The FCRA and EEOC guidance are a floor. State and municipal law adds ban-the-box timing rules, fair chance requirements, lookback limits and restrictions on specific data categories. Employers hiring across jurisdictions generally either apply the strictest applicable standard everywhere or configure the process per location.

General information only, current as of October 2026, and not legal advice. Background screening requirements vary by jurisdiction and change frequently. Have qualified counsel review your disclosure documents, screening policy and adverse action process before relying on them.