FCRA background check basics for employers: disclosure, consent and adverse action

This page covers FCRA background check basics for employers in plain language. It explains when the Fair Credit Reporting Act applies, what has to happen before you order a report, what has to happen before and after you turn someone down because of it, and how to use criminal history without creating discrimination risk. It also covers the employment background check rules that sit alongside the FCRA, such as federal nondiscrimination law.

What the FCRA covers

Asking about a candidate's background is generally allowed. Federal guidance says that, apart from certain restrictions on medical and genetic information, it is not illegal for an employer to ask background questions or to require a background check. For a primer on what these checks usually include, see what a pre-employment background check is.

The FCRA applies when you run checks through a company in the business of compiling background information. The Federal Trade Commission enforces it. The Act protects information collected by consumer reporting agencies, such as credit bureaus, medical information companies and tenant screening services. Report information can only go to someone with a purpose the Act specifies. The Act also says that users of report information for employment purposes must notify the person when they take adverse action based on it.

A second set of rules applies no matter where the information came from. Any time you use background information to make an employment decision, you must comply with federal nondiscrimination laws. Those laws cover race, color, national origin, sex, religion, disability, genetic information (including family medical history) and age (40 or older). The Equal Employment Opportunity Commission enforces them.

• FCRA: applies to reports from a company that compiles background information. Enforced by the FTC.
• Federal nondiscrimination laws: apply to background information from any source. Enforced by the EEOC.
• State and local rules: some states and municipalities regulate how background information is used for employment, so check yours.

If your team is new to the nondiscrimination side, start with these EEO basics for recruiters.

Disclosure and authorization

Before you order a report from a background check company, the FCRA requires additional steps. Notify the applicant or employee that you will get a report, and get their written permission. The permission can be part of the same document you use to notify them. If you want the authorization to cover reports throughout the person's employment, say so clearly and conspicuously.

You also certify to the background check company that, among other things, you notified the applicant and got their permission. In practice, the company will usually not run the report until that certification is in place.

What this means for your workflow

• Do not order a report until the signed permission is on file for that candidate.
• Keep the notice and permission with the candidate record so anyone on the team can confirm it exists.
• If you plan to rerun checks during employment, make sure the authorization says so clearly before you rely on it.
• Use the same notice and permission documents for every candidate in the same role.

Pre-adverse and adverse action

Adverse action includes not hiring an applicant or firing an employee. When that decision is based on a report from a background check company, the FCRA adds requirements in two stages: before you act and after you act.

Using criminal history responsibly

Start with consistency. Federal guidance says to treat everyone equally, and gives an example: asking only people of a certain race about their financial histories or criminal records is evidence of discrimination.

Next, look at the policy itself. Employers should not use a policy that excludes people with certain criminal records if it significantly disadvantages people of a particular race, national origin or another protected characteristic and does not accurately predict who will be a responsible, reliable or safe employee. The guidance tells employers to take special care with background problems that may be more common in protected groups.

Disability matters too. Be prepared to make exceptions for problems revealed during a background check that were caused by a disability, and let the person show they can do the job unless that would cause significant financial or operational difficulty.

• Run the same check for everyone in the same role, at the same stage.
• Write down how a record relates to the duties of the job before you decide.
• Give the person a chance to explain, especially where a disability may be involved.
• Check state and municipal rules, since some regulate how this information is used.

Recordkeeping and disposal

Personnel and hiring records, including applications from people you did not hire, must be kept for one year after they were made or after a personnel action, whichever comes later. Some employers, such as educational institutions and state and local governments, must keep them longer. If someone files a charge of discrimination, keep the records until the case is concluded. When you no longer need background reports, dispose of them, and any information taken from them, securely.

Common mistakes

• Ordering the report before written permission is on file.
• Running checks only on some candidates for the same role.
• Sending a rejection before the pre-adverse step is complete.
• Rerunning checks on employees when the original authorization did not clearly allow it.
• Applying a blanket criminal record rule without asking whether it predicts job performance or safety.
• Throwing reports in the trash instead of disposing of them securely.

A sample background check stage checklist

1. Notice sent to candidate that a report will be obtained.
2. Signed written permission received and saved to the candidate record.
3. Ongoing checks? Confirm the authorization says so clearly.
4. Certification to background check company completed.
5. Report received. Reviewed against job-related criteria written down in advance.
6. If considering adverse action: pre-adverse items sent. Rejection on hold.
7. Final decision made. Post-adverse notice sent. Channel and date recorded.
8. Records kept for the required period, then disposed of securely.

Where your ATS fits

Software does not make a process compliant. People and policies do. What a good system can do is keep the steps visible and the messages consistent. ATS Mako includes native SMS and an integrated email client, so recruiters can reach candidates from the same place they manage the pipeline. See how the communication engine and conversational SMS and automations work. Once a candidate clears screening, onboarding steps such as I-9 document collection follow.