The Employer’s Guide to Navigating Background Check Compliance
Master screening compliance at any scale
Two mistakes drive most background check compliance violations: missing or incomplete authorization forms, and inconsistent screening criteria across locations, roles, and business units. Achieving compliance-ready screening consistency is no small feat when faced with the ever‑evolving mix of local, state, and federal background check laws, dispersed hiring teams, and the rise of AI-powered hiring fraud changing the game.
This guide shares practical strategies to help employers and hiring managers:
- Stay compliant with core federal requirements and avoid common violations.
- Tackle hiring fraud with effective prevention policies and tools.
- Keep pace with new and changing regulations, from Ban the Box to Clean Slate laws.
- Build consistent adjudication workflows and choose a background check partner that supports compliant hiring at scale.
Background checks and the laws that regulate them
Background checks collect and verify a person's information from private and public sources. Employers use them to confirm qualifications, reduce risk, and meet industry-specific requirements. The process is subject to federal, state, and local laws that protect consumer rights, reduce discrimination, and prevent the use of obsolete or inaccurate information.
Common types of background checks
Which screenings you run will depend on your industry and the roles you hire for. All of the following common background checks are often subject to compliance regulations based on your region, industry, and background check provider.
- Criminal background checks: Regulated by the FCRA, EEOC guidance, and state and local Ban the Box laws.
- Driving record (MVR) checks: Regulated by the FCRA and state DMV rules, with additional federal DOT and FMCSA rules for commercial drivers.
- Employment and education verification: Regulated by the FCRA.
- Drug testing: Regulated by the FCRA and state and local laws, with federal DOT requirements for some regulated roles.
- Civil court checks: Regulated by the FCRA.
- Credit history checks: Regulated by the FCRA, plus restrictions in 11 states, Puerto Rico, and four municipalities.
- Professional license verification: Required on an ongoing basis for many healthcare, financial services, and skilled-trade roles.
- Reference checks: Minimally regulated, but still subject to anti-discrimination law.
Identity verification (IDV), while not a background check, is worth mentioning with this list as part of a comprehensive screening program. IDV is not regulated by the FCRA or widespread legislation, and confirms identity through methods such as liveness scans, biometric scans, and document verification.
Why does background check compliance matter?
Compliance isn't an abstract risk. The FCRA allows statutory damages of up to $1,000 per violation, plus punitive damages, and class actions multiply that exposure fast. Beyond the dollars, a compliance slip can cost you the hire, the candidate's trust, and in regulated industries, the contract or license the role was for.
Read the Report: The 2026 State of Screening Compliance
2,500 HR leaders weigh in on compliance, fraud, and essential background check strategies for successful teams.
Federal compliance laws and common violations
Fair Credit Reporting Act (FCRA)
The FCRA is the federal law governing background check providers, which the law calls consumer reporting agencies (CRAs), and the employers who use their reports. Checkr, for example, is a CRA, and background checks ordered by Checkr customers are regulated by the FCRA. If you send your own employees to the county courthouse, the FCRA doesn't apply. See law.
Because of the complexities of running background checks and the high overhead cost of manually managing a screening program, many employers choose to order verifications through a CRA—whether they run 10 or 1,000 checks per year. And so, the FCRA should be top of mind for most hiring managers.
Important points for establishing compliance with the FCRA
Provide written disclosure
All candidates must understand that they will undergo a background check and that any results within the report may be used to make hiring, promotions, or retention decisions. This disclosure must be clear, conspicuous, and standalone—on its own screen or sheet of paper.
Obtain consent
You must receive written authorization from the candidate before ordering a background check.
Provide requested information
Candidates are entitled to request and receive information about the CRA conducting the background check, along with a summary of their rights under the FCRA.
Run the report after you’ve gotten consent
After the steps above have been completed, a third-party agency can conduct a background check on the candidate on behalf of your company.
Review the results
After the background check has been completed, you can review the results. You must provide a copy to the candidate if they have requested it prior to the background check.
Make a decision
If you decide not to move forward with a candidate based on information in the background report, you must follow additional steps to ensure compliance. If there isn’t any potentially adverse information on the report, the background check process is complete.
Document and follow your adverse action process
In the context of background checks, adverse action is any action you take based on the information in a report that negatively affects someone’s employment. This could mean denying them employment, but can also include denying a promotion or transfer, offering employment in a lesser position, or other negative outcomes.
The adverse action workflow is critical because it allows the candidate to raise any concerns about their report, and the FCRA requires that employers/end users (which includes companies that use independent contractors) follow this process.
Reinvestigate disputed items
If the candidate disputes any information on the report, the background check company will conduct a reinvestigation specific to the contested portion of the report. They must provide a “reinvestigation complete” report to both the candidate and employer within 30 days.
Top two FCRA compliance violations—and how to avoid them
Most FCRA class actions against employers fall into one of two buckets. Knowing the shape of each is the best prevention.
1. Disclosure violations
The lawsuit is almost always the same: the required disclosure wasn't clear and conspicuous, wasn't standalone, or contained "extraneous language."
How to avoid a disclosure violation
Pull your current consent form and read it top to bottom. If there's anything on the page other than the federal FCRA disclosure and the candidate's signature line, you have a disclosure violation risk. State notices go in a separate document. Liability releases go in a separate document. Everything else goes in the application, not in the consent form.
Pro tip: Checkr provides built-in compliance tools that automate proper disclosure and authorization form creation for every background check—making it simple to avoid this common mistake.
2. Adverse action violations
Most adverse action lawsuits come from two specific failures: no pre-adverse notice sent, or the employer didn't wait the required window between pre-adverse and final notices.
You can improve your adverse action compliance by making sure your team always follows these steps when taking adverse action to comply with the federal FCRA. (Ban the Box laws in the states where you hire may add additional stipulations to this process, such as specific disclosure forms or longer waiting periods.)
How to avoid, step one: Send a pre-adverse action notice
This is a letter that informs the applicant that the background check is under review and a decision is pending. You have to provide a copy of the background check report and what’s called “a Summary of Rights” along with the notice. The Summary of Rights is a document provided by the Consumer Financial Protection Bureau (CFPB), and working with a background check provider allows you to automatically send this summary when initiating adverse action. If you're DIYing background checks, it is available on the CFPB website.
How to avoid, step two: Wait at least five business days
After providing the pre-adverse notice, you must provide time for the candidate to respond (to dispute the information, for example). Five business days is usually considered adequate by federal law.
How to avoid, step three: Send a final adverse action notice
If, after the waiting period ends or after hearing from the candidate, you're still moving forward with the adverse decision, the final notice must:
- Inform the candidate of the adverse action (for example, denial of employment).
- Notify the candidate that the decision was based, at least in part, on the background check.
- Share the contact information for the CRA that performed the background check and a statement that the CRA was not the decision maker.
- Inform the candidate of their right to request a free copy of the report within 60 days and of the right to dispute inaccurate information.
See how the top two violations show up across 1,000+ employee organizations
The 2026 State of Screening Compliance Report breaks down where compliance errors cluster and which industries feel them hardest.
Equal Employment Opportunity Commission (EEOC)
The US Equal Employment Opportunity Commission (EEOC) enforces federal civil rights laws that make it illegal to discriminate against a candidate or an employee because of the person’s race, color, religion, sex (including pregnancy, gender identity, and sexual orientation), national origin, age (40 or older), disability, or genetic information. See law.
The EEOC suggests employers consider information in background checks, especially criminal records, based on an individualized assessment. This generally means that an employer informs the individual that they may be excluded because of past criminal conduct; provides an opportunity for the individual to demonstrate that the exclusion does not properly apply to them; and considers whether the individual’s additional information shows that the policy as applied is not job related and consistent with business necessity.
The Green Factors or “nature/time/nature” test
Three factors the EEOC encourages employers to consider when assessing criminal record impact in a background check.
- The nature and gravity of the offense (How severe was the offense?)
- The time elapsed since the offense, conduct, and/or completion of a sentence
(How much time has passed since the offense?) - The nature of the job held or sought (How relevant is the offense to the job?)
Ban the Box laws: A playbook for single or multi-state employers
Ban the Box started as a push to remove criminal-history checkboxes from job applications. It's now a patchwork of laws, policies, and ordinances (often called Second Chance or Fair Chance laws) that govern when in the hiring process an employer can ask about or run a criminal background check.
37 states, Washington DC, and more than 190 cities and counties now have Ban the Box policies on the books. Coverage varies: some apply only to public-sector employers, many extend to private-sector employers above a headcount threshold, and a handful apply universally.
The 2026 State of Screening Compliance Report found that 58% of HR leaders at large organizations say applying consistent screening processes across regions, business units, or roles is difficult. Ban the Box is a big part of why.
Six steps to mastering Ban the Box law compliance
Pull your hiring locations list and headcount by state
If you hire across multiple jurisdictions, for each location, check whether it falls in one of the 37 Ban the Box states or 150+ municipalities with ordinances. Then check each law's employer threshold, which most often kicks in above a specific headcount (often 15 or 25 employees). The intersection of those two lists is where you're on the hook. A candidate you're hiring into a Denver role is covered by Colorado's rules, not your corporate HQ state's, regardless of where your HR team sits.
Find out when you can run a background check
Most Ban the Box laws prohibit running a background check before a conditional offer or a first interview. Ensure anyone who orders a check has a single reference or source of truth for when a background check is permitted—like a centralized dashboard with automated compliance actions.
Confirm which records you can consider
Some Ban the Box laws prohibit consideration of non-convictions; some cap the lookback window at seven years; some exempt specific categories of roles. Working with a background check partner that automatically updates compliance workflows based on varying regional rules helps you minimize the risk of making a decision based on a criminal record that employers aren't meant to consider.
Review adverse action requirements carefully
Some Ban the Box laws require the pre-adverse action notice to include specific documentation, such as naming the exact record that could lead to adverse action. Some require a specific form (New York City and Los Angeles both do). If your current pre-adverse template is the same in every state where you hire, you have a gap.
Map waiting-period requirements
Federal law treats five business days as the floor for adverse action. Several Ban the Box laws require longer windows, and the longer window applies. Your background check provider should be able to automatically hold the correct timer per jurisdiction. If yours can't, a compliant workflow relies on your team manually tracking disparate waiting periods across candidate funnels.
Best practice: Perform an individualized assessment
Finally, make sure you’re performing an individualized assessment if required. When you’re ready to send your final adverse action notice, make sure to share the results of that assessment, and include any additional language required under your specific Ban the Box law.
Hiring fraud and identity verification
Hiring fraud shows up long before most candidates complete a background check. It shows up at the application, at the phone screen, on the interview video call. Synthetic identities, AI-generated credentials, deepfake interviewees, and candidates applying as someone else have moved the fraud problem upstream of the checks that used to catch it, and compliance owns a share of the exposure.
The numbers are catching up to the pattern. As of early 2026, only 31% of CHROs say they are extremely confident in their organization's ability to prevent hiring fraud. In a separate survey of hiring managers, 25% reported losses over $50,000 in the past year from hiring or identity fraud.
Why this is a compliance problem, not just a security one
The temptation is to hand this to security or IT. That misses what fraud actually does to your compliance posture:
- An FCRA report run on a false identity is still a report. Your authorization and disclosure, your adverse action workflow, your record retention: all of it executed against a person who isn't the person you're hiring. The audit trail looks correct and isn't.
- I-9 verification on Day 1 catches legal eligibility, not identity. The Form I-9 confirms someone has the right to work in the US. It was never designed to confirm that the person showing up on Day 1 is the person who interviewed, and a document that passes an I-9 review can still be the wrong person.
- Adjudication decisions inherit the identity assumption. A clean background check on a synthetic identity tells you nothing about the candidate standing in front of you. Your adjudicators can't weigh records that belong to someone else.
What identity verification actually verifies
Identity verification (IDV) is a separate check from the background check. It confirms that the candidate is who they say they are, before the FCRA process begins. A complete IDV check has three components that work together:
- Document verification. A live capture of a government-issued ID (driver's license, passport, state ID), with authenticity validated against known security features, barcode data, and document design.
- Biometric and liveness match. A selfie that is confirmed to be a live person (not a photo of a photo, not a recorded video, not a deepfake) and that matches the photo on the ID.
- Device and location risk signals. Background checks on the connection itself: VPN use, location mismatches, device history. These catch patterns that a clean document and a matching selfie can miss.
Where IDV belongs in the workflow
The argument for putting identity verification before the background check is mostly a compliance argument, not a fraud argument. If IDV fails, the background check isn't run, which means no FCRA report exists on a false identity, no authorization was collected from the wrong person, no adverse action workflow is spun up for a record that doesn't belong to the candidate.
- IDV is non-FCRA. A failed IDV doesn't go through the adverse action workflow. It has its own outcome path, typically with the candidate given a chance to resubmit before the background check is canceled. Write this into your hiring policy so recruiters and hiring managers know what to do when a candidate doesn't pass.
- Your hiring funnel needs an IDV branch. What happens when IDV passes, what happens when it fails, and what happens when a candidate declines to complete it. This is a separate workflow from background check adjudication, but both should be managed from the same central dashboard (with the right background check partner).
- Candidate communication has to be clear. IDV is usually the candidate's first touchpoint with your screening process. A clean mobile flow, plain-language instructions, and transparent handling of failures protect both candidate experience and your audit trail.
How background checks, I-9s, and IDV fit together
The three steps verify different things, and each depends on the one before it being true.
Hiring step | What it verifies | What it does not |
Identity verification (IDV) | That the candidate in front of you is a real person and is who they claim to be | Their work history, eligibility to work, or qualifications |
Background check (FCRA) | Their past: employment, education, criminal history, driving record, etc. | That the history belongs to the person in front of you |
I-9 verification (Day 1) | Their legal eligibility to work in the US | That they are the same person who went through screening |
IDV anchors the other two. A background check run on a verified identity is a report you can act on. A background check run on a stolen or synthetic identity is a liability.
With Checkr, IDV can be automatically run as an optional step before the background check begins. If the candidate passes, the background check starts automatically with pre-filled, verified data from the ID. If the candidate fails, the background check isn't initiated.
Get the HR Leader’s Guide to Preventing Hiring Fraud with Identity Verification
New and changing regulations to watch
While there are some steadfast aspects to background check compliance, like the federal FCRA, state and local jurisdictions are passing new legislation all the time that could influence how employers conduct screenings and mitigate risk.
Let’s take a look at a few types of legislation trending across the US that could have implications for your background check compliance. For all of the latest 2026 updates, check out this guide.
I-9 and E-Verify laws
I-9 and E-Verify requirements are becoming more complex as both federal and state regulations evolve. In 2026, updated ICE guidance narrowed which Form I-9 errors are considered correctable, meaning more omissions and documentation issues may now trigger immediate fines. At the same time, a few states (notably Ohio and Illinois) are taking different approaches to E-Verify—some adding employer obligations around mismatch handling, others requiring its use in specific industries.
Even employers outside states with new legislation should pay attention. As more jurisdictions introduce their own rules for employment eligibility verification, organizations may need to revisit onboarding workflows, recordkeeping practices, and E-Verify procedures to reduce compliance risk and keep pace with changing requirements. Learn more.
Credit history restrictions
The FCRA sets federal limits on credit history checks to seven years—but it’s becoming more and more common for states to add their own regulations to these types of screenings. Currently, 11 states, Puerto Rico, and four municipalities have restrictions on the use of credit information in hiring decisions. If these requirements are violated during an employment background check, you could face significant civil and fiscal penalties.
Notably, New York State significantly restricted employer use of credit history beginning in April 2026. New York employers should update their screening programs to remove credit checks unless they clearly fall within one of these statutory exceptions. Learn more.
Complex web of laws and screening regulations makes compliance challenging
FCRA is a federal law governing how companies order and consider information contained in a background check. It covers all 50 states, plus Washington DC and Puerto Rico.
47 states plus Washington DC have enacted laws that make medicinal and/or recreational marijuana use legal for adults under at least some circumstances.
37 states and 190 cities/counties have enacted Ban the Box laws that vary greatly based on scope, nature, location and and jurisdiction, but generally restrict some employers from asking about a candidate’s criminal history on initial job application forms.
19 states and 19 cities/counties, plus Washington DC and Puerto Rico, have enacted salary history laws that vary based on location and jurisdiction, but generally prohibit employers from asking for previous salary information.
11 states and 3 cities, plus Washington DC and Puerto Rico, have enacted laws that restrict the use of credit information in hiring decisions.
Get the full rundown of screening laws you need to know in 2026
How to build consistent adjudication workflows
Adjudication is the process in which a company reviews background checks against the company’s hiring policies to make an assessment on whether to hire a candidate. This may seem straightforward, but each adjudication action can significantly delay the hiring process if you don’t provide your team with clear guidelines for consistent decision-making.
A recent Checkr survey found that the number of HR teams with dedicated adjudication teams has dropped from 18% in 2024 to just 8% in 2026. Meanwhile, 60% of compliance work now sits with general HR or onboarding teams, and two-thirds of those teams absorbed the added complexity without a headcount or budget increase. Adjudication is increasingly being done by generalists who also own onboarding, benefits, and everything else. Workflows have to carry the weight that specialists used to.
Five adjudication practices that hold up as you scale
- Create company-wide adjudication policies
Establish and communicate adjudication rules that align with applicable state and local laws, as well as industry best practices, for your hiring team. Your adjudication matrix should be input into your background check program, so background check reports can be automatically marked as clear or needing consideration. - Filter what adjudicators see to what's decision-relevant
Once you have adjudication rulesets in place for each role and region, adjudicators can easily see only the records and information relevant for eachrole. With Checkr Assess running automated adjudication actions, hiring teams reduce adjudication volume by 75%. - Be mindful of disparate impact discrimination
A blanket policy against certain records may create a disparate impact on those in protected classes and expose your organization to legal liability. If you automatically disqualify candidates with criminal convictions, for example, this could disadvantage individuals of a certain race, color, national origin, sex, or religion, which are protected classes under Title VII of the Civil Rights Act of 1964. This is why individualized assessment can be important for avoiding illegal discrimination. - Normalize charge language with secure AI tools
In their original form, criminal charges appear in legal language that can be hard to decipher. Worse, the same charge can be written in very different ways across counties and states. Look for solutions like Checkr AI, which instantly classifies the type of charge and its disposition. - Give candidates a voice
Empower candidates with an opportunity to provide additional context for background check records before making a hiring decision. Ask your background check provider if they offer an easy avenue for collecting contextual information from candidates, like Checkr’s Candidate Stories feature, to support fair chance hiring.
How compliance shapes the candidate experience
Background checks can be an area of concern for candidates, and your candidates’ experience can get sidelined if workflows are clunky, communication is poor, or worst of all—your reports are incomplete or inaccurate.
Excellent compliance helps support a positive candidate experience and keep great talent in your pipeline.
- Candidates feel informed and engaged
By sending all necessary disclosures and timely candidate communication, you can keep prospects feeling confident they understand their background check every step of the way. - Your reports are accurate and complete
Candidates may feel stressed, file time-consuming disputes, and even drop out of your hiring flow if your background checks include incorrect information. Focusing on accuracy and partnering with an FCRA-compliant screening partner to create reports helps you build trust with top candidates. - The background check process is fast and smooth
The longer a candidate sits in your hiring pipeline, the higher the chance is that you’ll lose them to another offer. Consistent background check workflows that align with relevant regulations help you speed hiring without sacrificing safety.
What to look for in a background check provider
Whether you’re hiring your 1st or 10,000th employee, working with a background check partner like Checkr makes it easy to maintain compliance, mitigate risk, and hire qualified talent for your team as you grow.
When choosing a background check partner, look for the following features that can help you manage compliance and keep your checks on track.
- Regional compliance support. Your vendor should demonstrate strong support for multi-jurisdiction compliance, including Ban the Box requirements, location-specific forms, and ongoing updates as laws change.
- Scalability and customization. Look for a platform with compliance features that can be tailored to your hiring workflows and scaled easily as your business grows or regulations evolve
- Metrics and insights. Expect reporting and analytics that help you monitor compliance performance, track efficiency, and surface fair chance hiring and EEOC-related insights.
Simplify background check compliance with Checkr
Checkr helps employers simplify background check compliance with flexible, easy-to-use workflows designed to support hiring at any scale. From adjudication and adverse action to candidate communication, Checkr helps hiring teams and employers reduce risk, improve consistency, and stay aligned with evolving federal, state, and local requirements. With customizable screening tools, faster turnaround times, and 200+ ATS/HRIS integrations, you can fill roles with the best candidates—no matter how fast you need to move.
Checkr’s compliance engine helps customers create streamlined, easy-to-use workflows that align with applicable federal, state, and local laws, as well as your own background check policy and hiring criteria. From candidate communication and adjudication to adverse action, Checkr provides employers who hire at any scale the tools they need to mitigate risk.
Ready to turn compliance into a competitive advantage?
Get the fastest, most comprehensive background checks built for the way you work.
Disclaimer
The resources provided here are for educational purposes only and do not constitute legal advice. We advise you to consult your own counsel if you have legal questions related to your specific practices and compliance with applicable laws.