Background Checks and the FCRA: A Guide for US Employers
When a US employer uses a screening company to check a job applicant or employee, the Fair Credit Reporting Act (FCRA) sets the steps: a standalone disclosure, written permission, and two notices before and after you turn someone down. On top of that, federal contractors and many states and cities limit when you can ask about criminal history at all.
This post covers the disclosure and authorization, the pre-adverse and adverse action notices, fair chance laws in a few well-sourced places, where the EEOC stands after its October 2026 vote, keeping reports private, and rechecks. Then it shows how to collect the signed authorization in WorkZerk.
When the FCRA applies
A background report from a screening company is a consumer report, and the company is a consumer reporting agency (CRA). The FCRA covers its use for hiring, retention, promotion or reassignment (FTC: Using consumer reports). That includes criminal, driving, employment and education checks, not only credit reports.
If you search court records yourself, without a CRA, the FCRA steps below do not apply. Anti-discrimination law and state fair chance laws still do.
Step 1: The standalone disclosure
Before you order a report, you give the person a clear and conspicuous written disclosure that you may get a consumer report for employment purposes. The statute says it must be in "a document that consists solely of the disclosure."
In practice that means:
- It is not in your job application (FTC).
- It can include a brief description of the kinds of report you may order, as long as it does not confuse the reader.
- It cannot carry extra terms. FTC staff say it must not include, for example, a waiver of the person's rights (40 Years of Experience with the FCRA, section 604(b)(2)).
Extra wording, such as a liability release or other notices mixed in, puts the whole form at risk. Most screening companies supply a disclosure form. Check that nothing else has been added to it.
Step 2: Written authorization
You also need the person's written authorization before you order the report. It can be on the same page as the disclosure. Then you certify to the CRA that you gave the disclosure, got permission, and will follow the FCRA and equal opportunity laws (FTC).
An electronic signature generally counts. Under the federal E-SIGN Act, a signature may not be denied legal effect just because it is electronic.
Investigative reports
If the report includes interviews with references, neighbors or former colleagues about the person's character or reputation, it is an investigative consumer report. You must send a separate written notice no later than 3 days after you first request it. If the person asks, you then describe the nature and scope of the investigation within 5 days.
Steps 3 and 4: Pre-adverse and adverse action
If anything in the report leads you to reject, withdraw an offer, or demote or fire someone, there are two notices, in order.
| Notice | When | What it includes |
|---|---|---|
| Pre-adverse action | Before you decide | A copy of the report you relied on, and A Summary of Your Rights Under the Fair Credit Reporting Act |
| Adverse action | After you decide | The CRA's name, address and phone number; that the CRA did not make the decision; the right to dispute the report; and the right to a free copy from the CRA if they ask within 60 days (FTC) |
The Summary of Rights is a model form published by the CFPB, in English and Spanish, on its model forms page. Your CRA usually sends it with each report.
The FCRA sets no fixed wait between the two notices. FTC staff say "some reasonable period of time must elapse" (40 Years report), so the person can point out errors. Many employers wait at least 5 business days, which also matches the state and city rules below. The two notices cannot be in the same document.
What a report can contain
CRAs generally cannot report arrests, civil suits or most other negative items older than 7 years. Convictions have no federal time limit, and the 7-year limit does not apply to a job with an annual salary of $75,000 or more. Some states set shorter limits. California, for example, bars employers from considering most convictions more than 7 years old.
Penalties
For a willful violation, a person can sue for actual damages or $100 to $1,000 per violation, plus punitive damages and attorney's fees. The amount is per person, so a faulty form used for every applicant adds up.
Fair chance and ban-the-box laws
These laws decide when you may ask about criminal history, and what you must do before you act on it. They sit alongside the FCRA, not instead of it.
| Where | Who it covers | The main rules |
|---|---|---|
| Federal contractors | Contractors, for positions related to the contract | No criminal history questions before a conditional offer, for contracts from solicitations issued after December 20, 2021. Exceptions where the law requires a check, or for classified and national security roles. |
| California | Employers with 5 or more employees | No questions, checks or internet searches for criminal history before a conditional offer. An individualized assessment, then a written preliminary notice with the convictions, a copy of the report, and at least 5 business days to respond (at least 10 if they dispute the report's accuracy) (CRD fact sheet). A final written notice follows. |
| New York City | Employers with 4 or more employees, including for freelancers and contractors | No questions before a conditional offer. A written copy of the check and of your Fair Chance analysis, then at least 5 business days to respond. Since July 29, 2021 it also covers current employees and pending cases. |
| Illinois | Employers with 15 or more employees | No questions until the applicant is selected for an interview, or until a conditional offer if there is no interview. Under the Human Rights Act, a written preliminary notice and at least 5 business days to respond before a final decision. |
Many other states and cities have their own versions, and some cover only public employers. Check each place you hire. A screening company can tell you which notices apply where.
The EEOC and criminal records
On October 29, 2026, the EEOC announced it had rescinded its 2012 guidance on arrest and conviction records, effective immediately. That guidance had recommended an individualized assessment based on the offense, the time since it happened, and the job.
The rescission does not change the law. The EEOC's announcement says Title VII still bars race and national origin discrimination, and that the change is not a "license to engage in unlawful discrimination." Employers do not have to drop practices they adopted under the old guidance. The state and city rules above still require an individualized assessment where they apply, and the FTC and EEOC's joint advice still holds: apply the same standard to everyone in the same job.
Keeping consent forms and reports private
A background report holds an applicant's date of birth, addresses, and often their criminal and driving history. Treat it like a tax form.
- Keep it. EEOC rules require employment records, including those about rejected applicants, to be kept for 1 year after they were made or the decision was taken, whichever is later. Some federal contractors, schools and state and local governments keep them for 2 years. Keep everything while a discrimination charge is open.
- Limit who sees it. Hiring managers usually need the outcome, not the report.
- Dispose of it properly. Once you no longer need it, shred paper and delete electronic copies so they can't be read or reconstructed.
Rechecks
You can recheck an employee during their employment without a new form each time, if your original disclosure said so. FTC staff say a one-time disclosure can cover the application and later reports, as long as it states "clearly and conspicuously" that it covers both (40 Years report, section 604(b)(2)). If yours did not, give a new disclosure and get a new authorization. Some state laws need a fresh notice anyway, so ask your screening company.
The pre-adverse and adverse action steps apply to a recheck the same way. In New York City, the Fair Chance process also covers current employees.
This is general information, not legal advice. FCRA and fair chance rules change, and state and city rules vary, so check with an employment lawyer or your screening company for your situation.
What WorkZerk does with background checks
WorkZerk collects the signed form and keeps the record:
- Each person reads your disclosure and authorization PDF from a private link, with no account or password, and signs it with a typed name and a drawn signature.
- WorkZerk keeps the exact PDF they signed, with the time, their IP address and a fingerprint of the file, and you can download a signed copy at any time.
- You can attach the report to the person's contact record in a Sensitive field: stored encrypted, only admins can open it, and every view is recorded.
- You can show the authorization only to people who have a conditional offer, so you stay within fair chance timing.
What it does not do: WorkZerk is not a consumer reporting agency and does not run background checks, order reports, or certify anything to a CRA. It does not write or send pre-adverse or adverse action notices, carry out an individualized assessment, or tell you which state rules apply. Your screening company and your team do those.
Setting it up in WorkZerk
1. Get your disclosure as a PDF
Ask your screening company for its disclosure and authorization form. Keep it as one PDF that holds only the disclosure and the authorization. If it covers checks during employment, make sure it says so.
2. Add fields for the report and the next check
Open Fields (opens in WorkZerk in a new tab) and add:
- Background check report, an Upload field. Open it, switch on Sensitive, and switch off Use AI to check expiry date.
- Background check completed on, a Date field.
- Next background check due, a Date field, if you recheck.
See custom contact fields and keeping sensitive information private.
3. Add the authorization to a portal
Open Portals (opens in WorkZerk in a new tab) and open your onboarding portal, or click New portal. On its Requests panel, click + Insert and add a Section called "Background check". Inside it, click + Insert, pick Sign PDF, name it "Background check disclosure and authorization", and choose your PDF. Leave Require a typed name and Require a drawn signature ticked. See asking someone to sign a PDF.
Keep it as its own request. Do not fold it into your handbook or other terms, since the disclosure has to stand alone.
4. Show it only after a conditional offer
On the section, open Limit who sees this and tick people under Show only for specific people as each one gets a conditional offer. Everyone else on the portal never sees it. The staff onboarding walkthrough shows how sections work.
5. Order the check once it is signed
Click View on the request's row to see who has signed. Download the signed copy if your screening company wants it, then order the report through them.
6. Attach the report, or the result
When the report arrives, open the person's contact and, on Details, attach it to Background check report. Fill in Background check completed on, and Next background check due if you recheck. If you only need the outcome on file, record the dates and keep the report with your screening company.
If the report leads you toward a no, send the pre-adverse action notice through your screening company or your own process, outside WorkZerk.
7. Delete reports you no longer need
After 1 year, or longer if your situation calls for it, remove the file from the contact's Background check report field. The dates stay. A file you attach yourself is not covered by automatic document retention, so this is a manual step. Every time an admin opened it is in Reports, then Sensitive information access.
Getting started
Start a free WorkZerk trial at workzerk.com, then work through the steps above. If you get stuck, the getting started guide walks through a first portal end to end, or email us at [email protected].