Which rules apply
Two sets of federal rules apply. The FCRA, enforced by the Federal Trade Commission (FTC), applies when you get a report from a company in the business of compiling background information, such as a criminal record or credit report from a screening company. Federal anti-discrimination laws, enforced by the Equal Employment Opportunity Commission (EEOC), apply to any background information you use, however you got it.
Many states and cities add their own rules on top, especially about criminal history. Those are covered below.
The FCRA process, step by step
- Decide what you check, for which roles, and apply it the same way to everyone in that role.
- Give a written disclosure that you may use the report for employment decisions. It must be in a stand-alone format and cannot be part of the job application. Only minor extra information, such as a short description of what a consumer report is, may be added.
- Get written permission. It can be on the same document as the disclosure.
- Certify to the screening company that you gave the disclosure, got permission, follow the FCRA, and won't misuse the information to discriminate.
- Review the report. If you are considering a rejection because of it, stop and send the pre-adverse action notice before you decide.
- Send the pre-adverse action notice with a copy of the report and "A Summary of Your Rights Under the Fair Credit Reporting Act." This gives the person a chance to review the report and explain anything negative.
- If you still decide not to hire, send the adverse action notice.
- Keep the records as long as required, then dispose of the report securely.
| Notice | When | What it must include |
|---|---|---|
| Pre-adverse action notice | Before you take the adverse action | A copy of the report you relied on and "A Summary of Your Rights Under the Fair Credit Reporting Act" |
| Adverse action notice | After you take the adverse action (orally, in writing or electronically) | That the decision was based on the report; the name, address and phone number of the screening company; that the company did not make the decision and cannot explain it; and the right to dispute the report and get a free copy from the company within 60 days |
The FTC's guidance does not set a fixed number of days between the two notices. The point of the first notice is to give the person a real chance to respond, so wait long enough for that. Some states set a minimum, such as California's five business days described below. If you ask for an "investigative report" based on interviews about a person's character or lifestyle, you must also tell them they can request a description of the nature and scope of the investigation.
Criminal records: arrests and convictions
The EEOC's 2012 enforcement guidance on arrest and conviction records explains how Title VII of the Civil Rights Act applies:
- An arrest is not proof that someone committed a crime, so an arrest alone should not be the reason for a rejection. You may look at the conduct behind it if it is relevant to the job.
- A conviction is usually enough evidence that the conduct happened, though records can be wrong or expunged.
- Weigh three factors: the nature and gravity of the offense, the time since the offense or sentence, and the nature of the job.
- Give the person a chance to explain (an individualized assessment): the facts around the offense, work history since, rehabilitation and references.
- Apply the same standards to everyone. Asking only some candidates about criminal records, based on race or another protected trait, is evidence of discrimination.
Fair chance and ban-the-box laws
Many states and cities limit when and how you can ask about criminal history. Two examples:
- California Fair Chance Act (employers with five or more employees): you cannot ask about criminal history until after a conditional job offer. Before deciding to deny the job because of a conviction, you must do an individualized assessment, send a written preliminary notice with a copy of the report, and give the person at least five business days to respond, plus five more business days if they dispute the report. Then you send a written final decision.
- New York City Fair Chance Act: most employers cannot ask about criminal records in job postings, applications or interviews before a job offer. To take adverse action afterward, you must find a direct relationship between the record and the job, or an unreasonable risk, using factors set out in the law, and give the person a copy of your written analysis, a copy of the background check and a chance to respond.
Other states and cities have their own versions. Before ordering a check, confirm the rules where the job is located. See the state pages for California and New York.
Keep records, then dispose of them safely
The EEOC requires employers to keep personnel and hiring records, including applications from people you did not hire, for one year from when the record was made or the action was taken, whichever is later. If someone files a discrimination charge, keep the records until the case is over. After that, the FTC requires secure disposal of background reports, for example by shredding paper and wiping electronic files so they cannot be read.
Common mistakes
- Putting the FCRA disclosure inside the application, or adding unrelated terms such as a liability waiver to it.
- Rejecting someone first and sending the report afterward, which skips the pre-adverse step.
- Sending the pre-adverse notice without the Summary of Rights.
- Running checks only on some candidates for the same role.
- Asking about convictions on the application in a place with a fair chance law.
- Treating an arrest without a conviction as disqualifying.
Common questions
How long should I wait between the pre-adverse and adverse action notices?
The FTC's guidance does not set a number of days, only that the person needs a real chance to review and respond. California requires at least five business days under its Fair Chance Act.
Do I need consent to look someone up online myself?
The FCRA consent and notice rules apply to reports from screening companies. Federal anti-discrimination laws apply to any background information you use, however you found it.
Where do I get the Summary of Rights?
The screening company should give it to you with the report. The Consumer Financial Protection Bureau publishes the model form.
How MambaHR handles this
MambaHR orders background checks through Checkr from the same hiring pipeline as the job post and the offer, and a person approves the decisions that matter. State rules such as fair chance laws come back with the law cited, unclear cases go to a person, and every change is logged.
Sources
- FTC and EEOC: Background checks, what employers need to know
- CFPB: FCRA model forms and disclosures (Summary of consumer rights)
- EEOC: Enforcement guidance on arrest and conviction records
- California Civil Rights Department: Fair Chance Act
- NYC Commission on Human Rights: Fair Chance Act in employment
Last reviewed October 2, 2026. This page is general information, not legal advice. Laws change and exceptions apply, so check the sources above or an employment lawyer before you act on a specific case.