Background check compliance is not optional, and the cost of getting it wrong can be steep. Over the past decade, employers and background-check companies have paid more than $325 million to settle litigation tied to background check violations. 

This guide explains what employers need to know about background check compliance, including FCRA requirements, EEOC background check guidelines, the adverse action process, ban-the-box laws, and state-specific rules that affect when and how screening can be used. 

If your organization relies on employment screening, this is the practical framework you need to reduce legal risk and make more informed hiring decisions. 

FCRA Background Check Compliance: What Employers Must Do 

The Fair Credit Reporting Act (FCRA) is a federal law designed to promote the accuracy, fairness, and privacy of consumer information collected and shared by consumer reporting agencies.  

Consumer reporting agencies can include credit bureaus, tenant-screening companies, medical information companies, and employment-screening providers, depending on the type of report being prepared. 

When an employer orders a background check from a third-party screening company, that report is generally treated as a consumer report under the FCRA, and the screening provider is treated as a consumer reporting agency. 

That is what triggers the disclosure, authorization, and adverse action requirements employers need to follow. In other words, background check compliance is not just about what appears in the report. It is also about how the report is requested, disclosed, and used in the hiring process. 

The FCRA also limits who can receive consumer report information; in general, the report can only be provided when there is a permissible purpose under the law. 

1. Is an employment background check a consumer report? 

In most employment settings, yes. If an employer uses a third-party company to obtain criminal history, employment history, education history, credit information, or other screening data for hiring, retention, promotion, or reassignment decisions, that report is technically a “consumer report” and the provider is a “consumer reporting agency (CRA)” under the FCRA. That means the employer must follow federal background check legal requirements before and after the report is ordered. 

2. Before the Background Check – Disclosure & Authorization 

Before ordering the report, employers must provide a clear, standalone disclosure telling the applicant or employee that a consumer report may be obtained for employment purposes, and they must also obtain written authorization. The FTC is explicit on this point: the disclosure must be presented in a document that consists only of the disclosure, without unrelated waivers, releases, or extra policy language mixed in. This is one of the most common breakdown points in employer background check policies. 

And this is not a technicality with no real-world consequence. In 2017, Costco agreed to a $2.5 million settlement in litigation alleging that its background check disclosure form did not satisfy the FCRA’s standalone disclosure requirement. For employers, the lesson is straightforward: even if the screening itself is lawful, a disclosure form that includes extraneous language can still create class-action exposure. That is why disclosure and authorization deserve the same attention as the report itself. 

The 3-Step FCRA Adverse Action Process

If an employer may reject, suspend, or otherwise take negative action based in whole or in part on a background report, the FCRA requires a specific process. This is one of the most important parts of background check compliance, because even an accurate report can still lead to legal exposure if the employer skips one of these steps. 

Step 1: Pre-adverse action letter 

Before making the final decision, the employer should provide the applicant or employee with: 

• a copy of the consumer report, 
• a copy of “A Summary of Your Rights Under the Fair Credit Reporting Act,” 
• a clear deadline for the individual to respond or dispute the information before the decision becomes final. 

Disclosure rules can also vary by state, and some states require employers to provide background check results to the candidate when requested at the time of authorization. 

This step is where many technical violations happen. The practical lesson for employers is that background check compliance begins before the report is used and continues through every notice that follows. 

Step 2: Waiting period 

After the pre-adverse action letter is sent, the employer should allow the individual a reasonable chance to review the report and dispute inaccurate information. In practice, many employers use five business days as the waiting period. This step matters because the person being screened must have a real opportunity to challenge errors before a final employment decision is made.  

Applicants and employees have several rights under the FCRA, including the right to be told if information in their file may be used against them, the right to know what is in their file, the right to dispute incomplete or inaccurate information, and the right to give consent before reports are provided to employers. Instead of reproducing the full consumer-rights list here, employers should review the FTC’s consumer advice on employer background checks and make sure those rights are reflected in their hiring process. 

If the individual disputes information in the report, the consumer reporting agency generally has 30 days to reinvestigate and report its findings. 

Step 3: Final adverse action notice 

If the employer still decides to move forward with the negative decision after the waiting period, it must send a final adverse action notice. That notice should state that adverse action is being taken based on the report, provide the name, address, and phone number of the consumer reporting agency, explain that the agency did not make the decision, and inform the individual of their right to dispute the report and request another free copy. 

The importance of this process was highlighted again in Schumacher v. SC Data Center, where the dispute centered on an offer being withdrawn before the applicant was properly given the report and the opportunity to respond. 

The 7-Year Lookback Rule  

One of the most misunderstood parts of background check compliance is the so-called 7-year lookback rule. Under the FCRA, certain types of adverse information generally cannot be reported if they are older than 7 years. That typically includes arrests that did not lead to conviction, civil judgments, paid tax liens, and other non-conviction adverse information. Bankruptcy records are treated differently and are generally reportable for up to 10 years under federal law. 

What the federal rule does not restrict is criminal convictions. At the federal level, convictions may generally be reported indefinitely, although many states impose stricter limits. That is why employers should never assume one national rule answers every compliance question. 

There is also an important salary exception. For positions expected to pay $75,000 or more, the FCRA’s 7-year limit on many non-conviction adverse items does not apply. 

For employers using third-party screening providers, the practical takeaway is simple: the report is only part of the compliance story. The process around the report matters just as much. That is why many organizations rely on AIS employment screening services to help support compliant workflows while reducing administrative burden. 

EEOC and Title VII Background Check Compliance 

Background check compliance does not stop with the FCRA. Employers also need to understand how EEOC background check guidelines and Title VII affect the use of criminal history in hiring. The key issue is not whether an employer can consider criminal records at all, but whether the policy is applied fairly, consistently, and in a way that is job-related and supported by business necessity. That is why background check compliance requires both a lawful screening process and a hiring policy that can withstand EEOC scrutiny. 

1. What Title VII Requires in Background Checks 

Under Title VII and the EEOC’s enforcement guidance, employers can run background checks, but they cannot use criminal records in ways that create unlawful discrimination. The EEOC highlights two main risks: 

• disparate treatment, where candidates are treated differently because of a protected characteristic, and 
• disparate impact, where a neutral policy disproportionately screens out members of a protected group.  

This is why blanket “no convictions” policies are risky. If an employer automatically excludes anyone with a criminal record, without considering the details of the offense or the duties of the role, that policy may be difficult to defend. This reflects the long-standing principle that criminal-record decisions should be tied to the actual risks of the role, not applied as blanket exclusions. 

Employers should also develop written background check guidelines and apply them consistently to candidates for similar roles, based on the requirements of the open position rather than subjective demographic considerations. 

2. The Green Factors: Individual Assessment of Criminal Records 

The EEOC’s practical framework for using criminal records is built around 3 factors employers should review before taking action: 

• The nature and severity of the offense  
• The time that has passed since the offense, conduct, or completion of the sentence  
• The relationship of the record to the duties of the job  

This kind of individualized review helps employers move away from one-size-fits-all exclusions and toward more defensible hiring decisions. It also aligns with the broader benefits of background checks for employers when screening is used thoughtfully rather than automatically. 

3. Protected Characteristics to Avoid 

Employers should be especially careful when a background check reveals information tied to protected characteristics such as age, citizenship, pregnancy, sexual orientation, disabilities, gender, religion, or race. Even if the employer never intended to use that information, exposure to it can still create risk if a later decision appears connected to a protected trait. 

The EEOC’s arrest and conviction resources make clear that the safest approach is to focus only on job-related information and to use a structured process that limits unnecessary exposure to protected details. 

This is one reason many employers rely on third-party screening partners and standardized review workflows: they help keep the focus on job-relevant findings while reducing unnecessary exposure to protected information. 

Ban-the-Box Laws and the Fair Chance to Compete Act 

Background check compliance is not only about what employers can screen for. It is also about when they can ask about criminal history. That is where ban-the-box laws and the Fair Chance to Compete Act come in. These rules do not ban criminal background checks outright. Instead, they restrict the timing of criminal history inquiries and, in many jurisdictions, require employers to wait until later in the hiring process, often after a conditional offer, before using criminal background check services. 

1. What Ban-the-Box Laws Require 

In plain English, ban-the-box laws are designed to remove criminal history questions from the earliest stage of hiring. At the state and city level, the rules vary widely, but the practical trend is clear: many employers must wait until after a conditional offer before asking about criminal history or ordering a criminal background check. 

2. The Fair Chance to Compete for Jobs Act (FCA) 

At the federal level, the Fair Chance to Compete Act applies to federal agencies and private companies seeking federal contracts. In general, it prohibits asking about criminal history until after a conditional offer has been made.  

For federal contractors, that means removing criminal history questions from job applications, not asking during interviews, and waiting until the conditional-offer stage before requesting that information. 

3. States and Cities with Ban-the-Box Laws 

Ban-the-box laws are no longer limited to a handful of jurisdictions. According to the National Employment Law Project, 37+ states and 150+ cities and counties have adopted some form of fair-chance policy.  

Some of the most closely watched jurisdictions include California, New York City, Colorado, Massachusetts, and Illinois, all of which impose meaningful timing or procedural restrictions on when criminal history can be considered. The state-by-state section below highlights the most important differences employers should know. 

Background Check Compliance by State: Key Requirements for Employers 

Federal law sets the baseline, but background check compliance by state is often where the biggest legal differences appear. For multi-state employers, the real challenge is that the requirements for background checks can change depending on where the employee will work, especially when it comes to ban-the-box timing, credit-check restrictions, lookback periods, social media privacy rules, and clean slate laws.  

The table below is a working summary for general guidance only. Because laws for background checks change frequently, every state entry should be verified before publication, and employers should consult legal counsel before relying on any state-specific screening rule. 

Note: This table is a summary for general guidance only and should be verified before publication. State and local background check legal requirements change frequently, and employers should consult legal counsel for their specific jurisdictions. 

1. California 

California creates some of the highest employer exposure in the country because multiple hiring rules can apply at once. Employers may need to account for the Fair Chance Act, the Investigative Consumer Reporting Agencies Act (ICRAA), off-duty cannabis protections, and the state’s salary history ban within the same hiring workflow.  

For many employers, California is the clearest example of why one national policy rarely solves every background check compliance issue. 

2. New York City 

New York City’s Fair Chance Act is one of the most detailed local fair-chance laws in the country. It effectively creates a two-stage background check requirement, sharply limiting what employers can ask before a conditional offer and then imposing a structured process before adverse action may be taken after criminal-history review.  

Employers hiring in New York City should not assume statewide rules are enough, because the city’s local requirements often create the real compliance risk. 

3. Illinois 

Illinois employers face a more layered analysis than many other states. Under the Illinois Human Rights Act, employers generally must assess whether a conviction is substantially related to the job before taking adverse action, and in the Chicago area, local rules such as the Chicago executive order can add another layer of compliance.  

For many employers, Illinois is less about one rule and more about applying role-specific judgment consistently. 

Background Check Compliance Best Practices for Employers 

Use this checklist to strengthen background check compliance and build a more defensible screening process: 

• Use a standalone FCRA disclosure form with no extraneous language.  
• Obtain signed written consent before ordering any background check.  
• Apply the same background check policy consistently across similar roles.  
• Complete the full 3-step adverse action process before rejecting a candidate based on report findings.  
• Check state and local requirements for ban-the-box timing, lookback rules, and credit-check restrictions.  
• Assess criminal records individually using the Green factors instead of blanket exclusion rules.  
• Work with an FCRA-compliant screening provider that helps reduce provider-side compliance risk, such as employment background screening services.  
• Retain disclosure, consent, and adverse action records for documentation purposes.
• Review and update your policy annually because background check laws change frequently. 

Final Thoughts 

Background check compliance is not a one-time task. It requires employers to manage federal requirements, EEOC guidance, state and local rules, disclosure obligations, and adverse action procedures as part of a consistent hiring process. As these laws continue to evolve, the safest approach is to treat compliance as an ongoing workflow rather than a final step after a report is ordered. 

For employers that want additional support, AIS helps make that workflow more manageable with FCRA-aware reporting, disclosure and authorization support, and adverse action process guidance aligned with the requirements covered in this article. AIS also carries indemnity coverage to help reduce provider-side compliance risk.