The law you're using without realizing it

The moment you pay a third-party screening company to run a background check on a candidate, you've stepped into the Fair Credit Reporting Act (FCRA) — even though nobody is checking anyone's credit. Under the FCRA, that screening vendor is a "consumer reporting agency," the background report is a "consumer report," and you, the employer, have a specific set of obligations. Class-action lawyers know this statute cold, and the most common claims aren't about what the report said — they're about how the employer handled the paperwork.

This is a practical recruiter-and-HR guide, not legal advice. State and local "ban-the-box" and fair-chance laws layer additional rules on top of the FCRA, so confirm specifics for your jurisdictions before you finalize a process.

Before you run the check: disclosure and authorization

Two documents have to come first, and they have to be done right:

  • The disclosure. You must give the candidate a clear, written notice that you intend to obtain a background report for employment purposes. The FCRA requires this disclosure to be in a standalone document — not buried in the job application, not stapled to the offer letter, not mixed with liability waivers or extra legalese. Courts have repeatedly punished employers who padded the disclosure with other content. One clean page that says what it needs to say.
  • The authorization. The candidate signs to authorize the check. You can put the signature line on the same standalone disclosure, but the consent itself must be there before the report is pulled.

Get these two wrong and you have liability regardless of whether the report comes back clean. The standalone-disclosure requirement is the single most litigated piece of the whole process.

The two-step adverse action dance

Here's the part that costs employers money. If the background report contains something that makes you inclined not to hire the candidate, you cannot simply reject them. The FCRA requires a two-step adverse action process with a real waiting period in between:

Step 1 — Pre-adverse action notice. Before you make the decision final, you must send the candidate:

  • A pre-adverse action notice telling them you're considering not hiring them based on the report,
  • A copy of the background report itself, and
  • A copy of the "A Summary of Your Rights Under the FCRA" document.

Then you wait. The law doesn't name an exact number, but the settled best practice is at least five business days. The point of the wait is to give the candidate a genuine chance to review the report and dispute errors — background reports are wrong more often than people assume (mismatched identities, outdated records, charges that were dismissed). If they come back and show the record is inaccurate, you may never need step two.

Step 2 — Adverse action notice. If, after the waiting period, you still decide not to hire, you send a final adverse action notice that includes:

  • A statement that the decision was based on the consumer report,
  • The screening company's name, address, and phone number,
  • A statement that the screening company did not make the decision and can't explain the reasons,
  • Notice of the candidate's right to a free copy of the report and to dispute its accuracy.

Skipping the pre-adverse step and the waiting period — going straight to "you're rejected" — is the classic violation. It denies the candidate the chance to fix a wrong record, and it's exactly what plaintiffs' attorneys look for.

Don't let the report make the decision for you

A background check surfaces information; it doesn't tell you what to do with it. A few disciplines keep you both compliant and fair:

  • Individualized assessment. A criminal record isn't an automatic disqualifier. EEOC guidance expects you to weigh the nature of the offense, the time elapsed, and its relevance to the specific job. A decade-old, unrelated misdemeanor for a desk role is very different from a recent, directly job-related conviction. Document your reasoning.
  • Apply the policy consistently. Inconsistent treatment of similar records across candidates is where disparate-impact claims grow. This is the same evenhandedness that keeps your screening and knockout criteria defensible.
  • Know what "ban-the-box" changes. Many states and cities restrict when you can ask about or run criminal history (often not until after a conditional offer) and require the individualized assessment in writing. Sequence your check accordingly.

How this fits with reference checks and the rest of screening

Background checks are a records tool; they sit alongside, not instead of, the human verification you do elsewhere. A clean background report tells you the person is who they say and has no disqualifying record — it tells you nothing about whether they were actually good at their last job. That's what reference checks that work are for. Run them as complementary steps, late in the funnel, after a conditional offer, so you're only paying for checks on candidates you actually intend to hire.

A compliant flow for a small team

Put together, the safe sequence looks like this:

  • Extend a conditional offer first (this also keeps you clean under ban-the-box rules).
  • Provide the standalone disclosure and collect authorization — one clean document, nothing extra.
  • Run the check through a reputable FCRA-compliant vendor.
  • If the report is clean, proceed. If it raises a concern, start the two-step adverse action process and honor the waiting period — never reject on the spot.
  • Do an individualized assessment and document it, every time.

In Hosting HR, the conditional-offer step, the disclosure task, and the adverse-action waiting period live as dated, owned tasks in the hiring pipeline so the five-day clock and the required notices aren't something a busy recruiter has to remember under pressure. The FCRA punishes process mistakes far more often than bad judgment — so make the process automatic.