Background Check Guide for Employers: Laws, Process & Best Practices

Last updated: August 20, 2026

By Mike Carter, Director of Partnership Success, KORE1

An employment background check is a third-party report on a candidate’s criminal, employment, education, and sometimes credit history, governed federally by the FCRA and Title VII and further restricted by fair-chance laws in fifteen states.

The report itself is rarely the problem. The paperwork around it is. The form you used to get permission, the notice you did or did not send, the eleven days a candidate sat in silence while legal argued about a misdemeanor from 2019.

KORE1 places contract and direct-hire talent in more than thirty U.S. metros, which means we run into fifteen different versions of this law in a normal quarter. We also get paid when you hire someone, and a background check is the last thing standing between us and that invoice. Weigh that against the section below where I tell you to add a week to your timeline.

The call that prompted this piece came from an operations director in Sacramento last spring. Her company had rescinded an offer to a warehouse supervisor after a county records hit, done it by phone on a Friday, and gotten a demand letter three weeks later. The conviction was genuinely disqualifying. The process was not. Those are two separate problems and she had budgeted for one.

Everything below is about running a background check for employment without creating a second problem: the federal floor, the state layer stacked on top of it, the seven-step process that survives a challenge, and the four places employers actually get sued. It is not a legal opinion. Your counsel still has a job. If you are staffing up broadly rather than solving one screening problem, our IT staffing services team handles the compliance mechanics on contract placements as a matter of course, which is a different arrangement than running it yourself.

What an Employment Background Check Actually Covers

An employment background check is a consumer report compiled by a third-party screening company that verifies a candidate’s identity and reports on some combination of criminal records, past employment, education, professional licenses, driving history, and credit. It is not one product. It is a menu, and you pick the items that relate to the job.

That last part is the whole legal theory. Every restriction in this guide traces back to one idea. You screen for what the job requires. Nothing else survives a challenge.

Here is the menu. Turnaround included, because that is the number your hiring manager will ask about first.

Notice the national database row. Screening vendors sell it as coverage and it is closer to a search index, assembled from whichever jurisdictions happened to upload data and whichever ones quietly stopped. It surfaces leads. A county-level search confirms them. Skip that second step and you will eventually reject the wrong James Rodriguez, and the real one will have a claim against you that costs more than every county search you were avoiding.

The Federal Floor: Two Laws Doing Two Different Jobs

People collapse these into one rulebook and then wonder why compliance advice contradicts itself. It does not. The Fair Credit Reporting Act governs how you obtain and act on a report. Title VII, enforced by the EEOC, governs whether the thing you found justifies the decision you made. You can satisfy one perfectly and lose on the other. That happens constantly.

The FCRA: A Sequence, Not a Checklist

The FCRA applies the moment you use a third party to compile the report. Run the search yourself in a public records portal and you are outside it. That sounds like a loophole. It is not, because you have also stepped outside the vendor’s accuracy protections while remaining squarely inside every state law that still applies to you.

The sequence, per the joint EEOC and FTC guidance for employers:

1. Standalone written disclosure. Tell the candidate you may use a consumer report for employment decisions, in a document that consists solely of that disclosure. Solely. There is a pile of lawsuits behind that word and we will get to it.
2. Get written permission. Signed, dated, kept somewhere you can produce it three years later, because the person who asks for it will be a plaintiff’s lawyer rather than an auditor and they will ask for all of them at once.
3. Certify to your screening vendor that you complied and will not use the report to discriminate. The vendor hands you this form. Read it once. Most companies have signed it eleven times and read it zero, which becomes relevant the first time someone asks what exactly you certified to and when.
4. If you are ordering an investigative consumer report, meaning one built on personal interviews about character and reputation, the candidate gets an additional notice and the right to request a description of its nature and scope.
5. Before you act on anything negative: send a pre-adverse action notice with a copy of the report and the “A Summary of Your Rights Under the Fair Credit Reporting Act” notice your screening company supplies. Then wait.
6. After the waiting period: send the final adverse action notice. Four things belong in it. The screening company’s name, address, and phone number. A plain statement that the screening company did not make this decision and cannot explain it. Notice of the right to dispute. Notice of the right to a free copy within sixty days.
7. Destroy the report when you are finished with it. Shred, pulverize, or wipe. The EEOC separately wants employment records held one year.

The statute never says how long to wait at step five. Five business days is the convention nearly everyone uses, and SHRM’s reporting on FCRA litigation names the same figure as the practical standard. Two days is defensible if your state stays quiet. Zero days is not a waiting period. Courts have said so.

Title VII: The Part That Decides Whether You Were Right

Criminal record screening is not illegal. Screening in a way that produces a disparate impact on a protected group, without job-relatedness to back it up, is.

The EEOC’s 2012 enforcement guidance on arrest and conviction records is still the operative document, and it draws a line most employers blur. An arrest is not evidence that anything happened. A conviction is. Reject someone over an arrest alone and you have handed the other side their opening argument.

For convictions, the guidance asks three questions borrowed from Green v. Missouri Pacific Railroad:

• What was the nature and gravity of the offense?
• How much time has passed since it, and since the sentence ended?
• What does this job actually involve?

Answer those three honestly and you have a targeted screen. The EEOC wants a second layer on top of it. That layer is the individualized assessment. Tell the person they were screened out and why. Give them a real chance to explain. Then actually weigh what comes back, and be able to say what changed or did not change once you had it.

A financial controller with a fraud conviction from 2022 is a straightforward no. The same conviction on a warehouse forklift operator is a much harder argument to make in front of an investigator, and a blanket policy that treats those two candidates identically is exactly the pattern the EEOC built this guidance around in the first place.

The Seven-Year Rule Everybody Gets Backwards

Here is the single most misquoted piece of federal screening law. Section 1681c of the Fair Credit Reporting Act bars screening companies from reporting civil suits, arrests, paid tax liens, collection accounts, or other adverse items older than seven years. Bankruptcies get ten.

Criminal convictions are carved out. The statute says “other than records of convictions of crimes,” which means federal law places no time limit on reporting a conviction at all. Congress removed that limit in 1998. A lot of HR training decks never caught up, and you can usually spot one by the confident slide asserting that nothing older than seven years can appear on a report.

Then there is the wrinkle that matters at the director level. Pay the job $75,000 or more, or reasonably expect to, and every one of those time limits stops applying. The federal seven-year window you were counting on for a VP of Finance search was never actually there.

Before anyone in California acts on that paragraph: your state deleted the salary exemption and imposes its own seven-year limit on conviction reporting. Which brings us to the part of this that costs employers the most money.

The State and City Layer

Thirty-seven states now have fair-chance hiring policies the National Employment Law Project tracks, plus the District of Columbia and upward of 150 cities and counties. Most of that only touches public employers. Fifteen states reach private hiring too. Check yours. Offices in California, Illinois, Massachusetts, New Jersey, or Washington put you in that group already, and hiring into Colorado, Connecticut, Hawaii, Maine, Maryland, Minnesota, New Mexico, Oregon, Rhode Island, or Vermont does the same thing. Roughly twenty-two cities pile on after that. New York City and Chicago come first.

Hire in one state and you learn one rulebook. Hire in eight and you need a matrix, plus somebody whose actual job is keeping it current. Nobody volunteers for that job.

California’s version, Government Code section 12952, is worth reading in full if you hire anywhere in the state. The threshold is five employees. Not fifty. Washington’s amended Fair Chance Act took effect on July 1, 2026 for employers with fifteen or more people, and the state Attorney General published an employer guide alongside it. Read that one before your next Seattle req opens.

We have watched that California sequence eat eight to twelve days off a start date. More than once. The cause repeats: nobody put the response window on a calendar, the hiring manager heard “conditional offer,” and somebody in Orange County started building a first-week onboarding schedule around a date that was never real.

Where Employers Actually Get Sued

Four patterns account for most of it. Not one of them involves getting the underlying judgment wrong about the candidate, which is the part hiring managers worry about and almost never the part that generates a demand letter three weeks after the rejection went out.

The disclosure form. The FCRA says the disclosure must appear in a document consisting solely of the disclosure. Employers keep stapling things to it: a liability waiver, a state-law addendum, an at-will acknowledgment, the vendor’s terms. SHRM’s coverage of FCRA litigation says the majority of employment-context claims arise around the authorization form. One extra paragraph on a form 4,000 applicants signed is a class action with a clean, countable class and no factual dispute worth arguing about.

Second: skipping the pre-adverse notice, or sending it and the final rejection the same afternoon. The waiting period exists so a candidate can dispute an error. Compress it to zero and you have told a court you never intended to hear one. Errors do happen. We have seen a dismissed charge reported as a conviction. We have seen a record attach to the wrong person entirely. Both were fixable in an afternoon by a candidate who got the chance to send one document.

Third, and this one is quieter. Adverse action letters that lack the screening company’s contact information, or that never say the screening company did not make the decision. Someone wrote that boilerplate in 2015. Nobody has read it since.

Fourth: blanket exclusions. “No felonies” as a company-wide rule, applied without regard to what the felony was or when it happened. That is a Title VII problem rather than an FCRA one, which puts you in front of a different plaintiff’s bar, with a different set of remedies and a charge-filing process that starts at the EEOC instead of in federal court.

A willful violation runs $100 to $1,000 per violation in statutory damages under section 1681n, and the statute stacks punitive damages and attorney’s fees on top of that. Multiply the low end by an applicant pool. The arithmetic writes itself.

Timing, Cost, and What Actually Delays a Start Date

A standard package on a domestic candidate runs $30 to $100 depending on scope and how many counties come back in the address trace. Executive packages cost more. Sometimes much more. Global education verification and credential checks can push one report past several hundred dollars.

Turnaround is where expectations break. Vendors advertise one to three days. They hit it most of the time. The exceptions repeat often enough to plan around:

• Counties that still require an in-person clerk search. Rural jurisdictions, mostly. Add three to five days.
• Education verification through a registrar over winter break. We once waited fourteen days on a bachelor’s degree from a small college in December, and there was nobody to escalate to because the office was closed.
• International records. Two to six weeks is normal. Escalation does nothing.
• Anything requiring a candidate to sit for a collection. The lab is not the bottleneck. The candidate is.
• A record hit that triggers the individualized assessment, in a state with a mandatory response window. Add five to twelve days. That is the good version.

KORE1’s average time-to-hire on IT roles sits at seventeen days. Screening is the piece of that timeline most likely to blow up, and when it does the cause is almost never the vendor. Nobody sequenced it. The fix is boring. Order the check the same hour the conditional offer goes out, and put the response window on the hiring manager’s calendar as a real date rather than a contingency nobody expects to hit.

Contract Versus Direct Hire Changes Who Owns This

On a direct hire placement, the employer runs the check. You are the end employer. So the FCRA obligations, the state notice requirements, and the litigation exposure all sit with you. An agency can recommend a vendor and manage the candidate’s expectations. It cannot move the obligation off your books.

On contract staffing, the staffing firm is the employer of record and runs the screening under its own program. The client sets the standard. We run it. That split matters more than it sounds, because the client company defines what disqualifies while the staffing firm carries the sequence, the notices, and whatever comes of getting them wrong.

Where this gets genuinely messy: client-mandated screening standards that exceed what the staffing firm’s own policy allows, in a state where the standard is unlawful. A client once asked us to exclude anyone with any conviction in the past ten years, for a warehouse role, in California. We said no. Nobody should mistake that for principle, since we are not in the habit of refusing revenue, but running that screen would have put our name on the complaint alongside theirs.

Ask your staffing partner two questions before the first req goes out. Who is the employer of record here? And whose adverse action process runs if something comes back? Slow answers are answers.

Drug Testing Became a Separate Conversation

Marijuana testing used to be a line item on the screening order. It is its own compliance question now, and the answer changes at the state line.

California’s AB 2188 took effect on January 1, 2024. Employers cannot penalize someone for off-duty cannabis use, and cannot act on a test that detects nonpsychoactive metabolites, which happens to be exactly what a standard urine panel detects weeks after use. Building and construction trades are exempt. Federally regulated testing, DOT roles included, is unaffected.

Six more states protect off-duty use, and the mechanics differ enough that one policy will not cover them. New Jersey wants a trained observer to document suspected impairment. New York bars pre-employment THC screening for most roles outright. Four others sit between those poles, so read Connecticut, Montana, Nevada, and Rhode Island individually rather than assuming the New York rule travels.

Practical version: keep drug testing for safety-sensitive and DOT-regulated positions, drop THC from the panel in protected states unless you can test for current impairment, and stop running the same nationwide panel you configured in 2019 because reconfiguring it is annoying.

Nine Practices That Hold Up Under Challenge

Ranked roughly by how often skipping them causes trouble.

Write the standard before you order the first report. For each role family, put on paper what disqualifies and why it relates to the duties. Do it while nobody has a face attached to it. Standards written in the abstract survive scrutiny. Standards reverse-engineered from a report that already came back do not, and the timestamps in your own document history will say which one you did.

Audit the disclosure form. This year. Pull the actual PDF your applicants sign, not the one in the policy binder, and confirm nothing else rides along on it.

Order after the conditional offer, everywhere, even in states that permit earlier. One sequence beats fifteen. You will also stop miscounting your headcount in Sacramento.

Build the response window into the offer letter. Not the compliance manual. The offer letter, with the start date already reflecting it. Hiring managers do not read compliance manuals and they do read offer letters.

Document the individualized assessment even where writing it is optional. California lets you skip the write-up. Skip it and your evidence is a conversation nobody took notes on.

Never decide off a database hit. County confirmation or nothing. No exceptions.

Train whoever sends the adverse action notices. That is usually a coordinator rather than counsel, and it is the desk where compliance either happens or quietly does not.

Re-check the matrix annually. Philadelphia moved in January 2026. Washington moved in July 2026. Something moves in 2027. The update will not come to you.

Last one, and it is the one people resist: define what a hit does not disqualify. A policy that lists only exclusions turns every unusual record into an escalation, and escalations sit. Name what passes. That is how you stop losing candidates to a legal review queue nobody is staffing.

What Hiring Managers Ask Us

Can we just run the check before we make an offer? It would save a week.

In fifteen states plus a couple dozen cities, no, criminal history cannot be considered until after a conditional offer. Elsewhere it is legal and still a bad habit. You spend the saved week explaining to a candidate why you pulled a report on someone you had not decided to hire. One relocation flips it from legal to unlawful.

The report came back clean but the dates on their last job are off by four months. Now what?

A discrepancy is not a finding. Ask about it directly before it turns into anything else. Registrars and HR departments get dates wrong constantly, contract-to-perm conversions confuse start dates, and a layoff with severance can produce two equally defensible answers about when employment actually ended. What matters is whether the story holds. Cagey is data. “The first four months were through a staffing agency” is bookkeeping.

How far back can we actually look?

Federal law puts no limit on reporting criminal convictions, and the seven-year limit on other adverse items disappears above $75,000 in salary. Your state may cut both of those down sharply. California caps conviction reporting at seven years and eliminated the salary exemption. Philadelphia now stops at four years for misdemeanors. Check the jurisdiction where the candidate will work, not where your headquarters sits.

What is the difference between a national criminal database and a real search?

A database aggregates whatever records various jurisdictions have uploaded, with gaps nobody publishes. A county search pulls from the court of record. Use the database to figure out which counties to search. Use the county result to decide. Vendors rarely volunteer the distinction, and the reason is not sinister so much as commercial: the database is the cheap, instant, high-margin part of the package they quoted you.

Our screening vendor says they handle adverse action. Are we covered?

Partially, and the gap is the expensive part. Most vendors will generate and send the notices for you. The certification you signed still makes the employer responsible for the decision, the timing, and the individualized assessment behind it. Vendors send letters. They do not conduct your Title VII analysis, and no plaintiff in the history of this statute has decided to sue the screening company instead of the employer on the theory that the letters went out automatically.

Can we rescind an offer over something we found?

Yes, if the finding relates to the job and you follow the sequence. The sequence is the whole answer. Preliminary decision in writing, copy of the report, summary of rights, a real waiting period, honest consideration of whatever the candidate sends back, then the final notice with the screening company’s contact details on it. Do all of that and still rescind and you are defensible. Do the same rescission by phone on a Friday afternoon and you are the Sacramento story from the top of this piece.

Do contract workers get screened to the same standard?

The standard is the client’s. The obligation belongs to whoever is the employer of record, which on a contract placement is the staffing firm. Clients set requirements that reflect their own risk tolerance and site access rules, and a staffing partner worth keeping will tell you when one of those requirements is unlawful in the state where the work actually happens. Put it in the agreement. Discovering it mid-placement costs more.

Where to Take This Next

Two things this month, in this order. Pull your disclosure form and read it the way an adversary would. Then pick your three highest-volume hiring states and write down, for each, when you may ask and how long you must wait.

Everything else here is downstream of those two.

Screening is a process problem wearing a legal costume, and process problems get fixed by handing them to one person with a calendar. If you would rather not staff that person, contract placements move the employer-of-record obligation to us by design. Our recruiters average more than fifteen years in this work across eight verticals. Retention at twelve months runs 92%. We have been doing it since 2005, in over thirty U.S. metros.

If interview structure is the next thing on your list, our technical interview guide for hiring managers covers the assessment side, and the HR staffing team handles compliance and talent operations roles for companies building this function internally. When you want the screening mechanics handled rather than documented, talk to a KORE1 recruiter about how it works on a live req.

This guide is general information about employment screening practices, not legal advice. Fair-chance and consumer-reporting rules change by jurisdiction and by year. Have employment counsel review your screening policy before you rely on it.