How to Run an Employee Background Check Legally (FCRA Steps)

Research guide, not hands-on testing: we did not open a Checkr account or run a check on anyone · FCRA, EEOC and fair-chance rules read on FTC, CFPB, EEOC, New York City and California government pages October 21, 2026 · Checkr prices checked on checkr.com/pricing the same day · This is not legal advice; for your own hiring process, talk to an employment lawyer · We may earn a commission if you sign up through links on this page.

To run a background check on an employee or job applicant legally in the US, you give the person a stand-alone written disclosure, get their written authorization, certify your purpose to the screening company, and only then order the report. If something in it may cost the person the job, you send a pre-adverse action notice with a copy of the report and the CFPB's Summary of Rights, wait a reasonable time for a reply, and then send a final adverse action notice. That is the federal Fair Credit Reporting Act (FCRA) sequence. Two other layers sit on top of it: EEOC guidance on how to weigh criminal records fairly, and state or city fair-chance laws that can change when you may look at criminal history at all.

This guide turns those rules into an order of work for a small employer: what to write down before the first check, which document goes out when, how long to wait, and what to keep afterwards. It ends with a one-page checklist and the cost of each piece at Checkr's posted prices. If you are still comparing what screening costs across providers, read our employer background check price comparison first; more guides sit in the HR and Hiring Tools section.

How to run a background check on an employee in eight steps

Here is the whole process on one screen. Steps 1 and 2 are your own decisions; steps 3 to 8 are where the FCRA sets the order.

1. Write a screening policy that says which searches each role gets and how records will be judged.
2. Decide when in the hiring process the check runs. Where a fair-chance law applies, that usually means after a conditional offer.
3. Give the stand-alone FCRA disclosure and get written authorization.
4. Certify to the screening company and order the report.
5. Review the results against your policy, with a person on your team making the call.
6. If a record may disqualify the person, send the pre-adverse action notice with the report and the Summary of Rights.
7. Wait, and read whatever the person sends back.
8. Send the adverse action notice if you still decide against them, then keep and later destroy the records properly.

Before you order anything: put the rules for each role on paper

The FCRA does not require a written screening policy, but the EEOC's guidance on criminal records makes one close to essential. The joint EEOC and FTC guide for employers tells you to "apply the same standards to everyone, regardless of their race, national origin, color, sex, religion, disability, genetic information (including family medical history), or age (40 or older)." The easiest way to prove you did that later is a document written before you saw anyone's report.

A workable policy for a small business answers four questions:

• Which roles are screened, and with which searches? A cashier, a delivery driver and a bookkeeper rarely need the same package. Tie each search to a duty of the job.
• Which records matter for which role, and for how long? The EEOC's 2012 enforcement guidance points to three factors from the court case Green v. Missouri Pacific Railroad: "the nature and gravity of the offense or conduct," the time that has passed since the offense or the end of the sentence, and "the nature of the job held or sought."
• How are arrests treated? The EEOC is direct: "The fact of an arrest does not establish that criminal conduct has occurred," and an exclusion based on an arrest alone is not job related and consistent with business necessity. You may look at the conduct behind an arrest if it makes the person unfit for that job.
• How does a candidate explain a record? The EEOC calls this an individualized assessment: you tell the person they were screened out because of a conviction, let them show why the rule should not apply to them, and consider what they send. Title VII does not require it in every case, but the EEOC says a screen without it "is more likely to violate Title VII."

One thing to leave out of the policy: blanket rules. The EEOC guidance says an "automatic, across-the-board exclusion from all employment opportunities because of any criminal conduct" is inconsistent with the Green factors. "No felons" in a job ad is also expressly named as off limits in California's fact sheet.

Where the check sits in hiring: the conditional offer question

Federal law does not say when in the process you may run a check. Many states and cities do, through fair-chance or "ban the box" laws. They differ in who is covered, what you may ask and when, and what notice you must give, so check the rules for the place where the person will work. Two large examples, both read on the enforcing agency's own pages:

Sources: NYC Commission on Human Rights, Legal Enforcement Guidance on the Fair Chance Act (updated for Local Law 4 of 2021); California Civil Rights Department, Fair Chance Act fact sheet (June 2025). Both checked October 21, 2026. Summaries only; each law has exemptions and more detail.

Even where no local law applies, the EEOC recommends as a best practice "that employers not ask about convictions on job applications." Running the check after a conditional offer is the simplest way to meet the strictest rule you are likely to hit.

The disclosure and the signature: what goes on the form

Before you order a report from a consumer reporting agency, the FCRA requires two things from you, and the FTC's guide "Using Consumer Reports: What Employers Need to Know" describes both.

• A stand-alone disclosure. Tell the person in writing that you may use the information for decisions about their employment. The notice "cannot be in an employment application." You may add a brief description of what consumer reports are, but only if it "does not confuse or detract from the notice." Anything else you want the candidate to sign belongs on a separate page.
• Written authorization. The person's permission can sit on the same document as the disclosure. If you want to re-check during employment without asking again, the FTC says to state that "clearly and conspicuously" in the authorization.
• An extra notice for investigative reports. If the report will include interviews with neighbors, friends or associates about the person's character or reputation, the FTC says you must tell the person in writing and let them ask for "a summary of the scope and substance of the report."

The CFPB's Summary of Rights, which candidates receive later, puts the same rule from their side: a reporting agency "may not give out information about you to your employer, or a potential employer, without your written consent given to the employer." It notes one exception: written consent "generally is not required in the trucking industry." Some states also add their own disclosure forms; California is one Checkr names.

Certifying and ordering: what the screening company needs from you

When you order, you certify to the screening company that you gave the notice, got permission, follow the FCRA, and will not discriminate or otherwise misuse the information. Checkr's customer agreement builds a check into the account itself: you get no access to the platform or to reports until Checkr approves your customer credential application.

Checkr also handles some of the paperwork in this step. It says that if you use its candidate workflow, "Checkr will automatically and seamlessly provide the company's disclosure and authorization forms" to candidates, who sign electronically, and it offers sample disclosure and authorization templates "that can be tailored." Treat any template as a draft for your lawyer to check against your state; the legal duty stays with the employer. If you want the forms, the order and the notices in one place, you can set up a Checkr account and send consent forms through it (affiliate link). Our Checkr review, written from its public terms and pricing goes through what the account does and does not handle.

Reading the report without a blanket rule

When the report comes back, a person on your team compares it with the written policy for that role. Software can sort and filter records, but the decision is yours, and the FTC's required notice tells the candidate exactly that: the reporting company "did not make the decision."

Three working rules come straight from the EEOC guidance:

• An arrest record on its own is not a reason to reject. Ask about the conduct behind it if the role makes that conduct relevant.
• Link any record to the job. The guidance looks at the duties, the level of supervision and the setting, such as work "in a private home" or with "vulnerable individuals."
• Treat equal records equally. The EEOC and FTC example: if you do not reject applicants of one ethnicity with certain records, you cannot reject applicants of another ethnicity with the same or similar records.

Also check that the report is about the right person. A wrong date of birth or a common name can attach someone else's record. The pre-adverse step exists partly for this reason: the FTC says the advance notice gives the person "the opportunity to review the report and tell you if it is correct."

Pre-adverse action: the notice, the report and the wait

If anything in the report may lead you to reject the applicant, withdraw an offer, or take another adverse action against an employee, you must first give the person:

• a notice that includes a copy of the consumer report you relied on, and
• "A Summary of Your Rights Under the Fair Credit Reporting Act," the CFPB's standard form.

Then you wait. The FCRA itself does not set a number of days. The most cited federal source is an FTC staff advisory opinion to attorney Eric Weisberg dated June 27, 1997: the staff wrote that "the five day period that you proposed appears reasonable," while adding that the facts of a particular situation "may require a different time." Staff opinions are not binding on the Commission. Checkr's own guide uses a longer figure: "7 calendar days is generally considered an adequate waiting period," and it warns that "some states and jurisdictions impose longer waiting periods." New York City and California both set at least five business days by law for criminal history decisions, as the table above shows.

The practical choice for a small employer: pick one waiting period that meets the longest rule where you hire, write it in your policy, and count from the day the person receives the notice. California's fact sheet notes that notices sent by regular mail count as received five calendar days after mailing to a California address. If the person replies with a correction or context, read it and record what you decided and why before you go further.

The final adverse action notice and what to keep afterwards

If you still decide against the person, send the adverse action notice. The FTC lists what it must contain:

• the name, address and phone number of the screening company that supplied the report;
• a statement that the company did not make the decision and "can't give specific reasons for it";
• the person's right to dispute the accuracy or completeness of the information, and to get an additional free report from the company if they ask within 60 days.

The FTC says this notice may be given "orally, in writing, or electronically"; a written or emailed copy is easier to prove later. California adds steps of its own: the final notice must describe any appeal procedure and tell the person they may file a complaint with the Civil Rights Department.

Then come the records. The EEOC and FTC guide says hiring records, including applications from people you did not hire, "must be preserved for one year after the records were made, or after a personnel action was taken, whichever comes later." That becomes two years for educational institutions and state and local governments, and until the case ends if someone files a discrimination charge. When you no longer need a report, the FTC says to dispose of it securely, for example by shredding paper and making electronic files unreadable.

What each step costs at Checkr's list prices

The legal steps themselves are mostly free: the disclosure, the Summary of Rights and the notices are documents. What you pay for is the report and, in a few places, mailing. These are the Checkr prices relevant to a standard employee check, as posted on checkr.com/pricing on October 21, 2026:

*Checkr notes that third-party court, database or DMV access fees "may apply," passed through at cost with no markup. Prices from checkr.com/pricing, checked October 21, 2026; before passthrough fees and tax.

A worked example: an office hire screened with the Essential package and a current-employer verification costs $59.99 + $12.50 = $72.49 before county court fees. If the check leads to a withdrawn offer and you want both notices mailed through Checkr in a jurisdiction that requires postal copies, add 2 × $7 = $14, for $86.49. The same person rechecked once a year on Essential adds $59.99 a year plus fees. A finance role screened with Complete plus a five-year employment verification ($25) and one degree ($12.50) comes to $132.49 before fees. For a fuller breakdown of passthrough fees on real orders, see Checkr's per-report prices with court fees added, and to compare a provider owned by the same company, read our Checkr or GoodHire comparison.

Identity comes first on the two larger packages. Checkr lists identity verification inside Essential and Complete (it is an add-on for Basic), and its identity verification page says the check "adds a quick document and liveness check before the background check starts": the candidate submits a government ID and a live selfie on a phone. Per the same page, "failed or incomplete verifications prevent a background check from starting," and candidates get up to three resubmission attempts. That matters for the FCRA steps above: an unverified identity is a reason the report never runs, not an adverse finding in a report (Checkr identity verification, checked October 22, 2026).

A one-page checklist to keep with each hire

Print this or copy it into your applicant tracker. Each line is a record you can show later.

• ☐ Role's screening package and record rules written in the policy, dated before the posting went live.
• ☐ Local fair-chance law checked for the work location; conditional offer made first where required.
• ☐ Stand-alone disclosure given; nothing else on that page.
• ☐ Written authorization signed (and covers re-checks during employment, if you plan them).
• ☐ Investigative report notice given, if the report includes interviews.
• ☐ State-specific disclosure or rights forms added where the work location requires them.
• ☐ Report reviewed by a named person against the role's written rules; identity match confirmed.
• ☐ If disqualifying: pre-adverse notice sent with the report and the CFPB Summary of Rights; date received logged.
• ☐ Waiting period from the policy met; any reply read and the outcome noted with a reason.
• ☐ Adverse action notice sent with the screening company's contact details, the "did not make the decision" statement and the dispute and 60-day free report rights.
• ☐ File kept at least one year from the decision; destroy date set; report shredded or deleted securely after that.

If the checklist is ready and you want to run your first order, open a Checkr account for employee screening (affiliate link). Setup terms and the current package list are on Saazora's Checkr offer page, and larger teams weighing other vendors can read Checkr compared with Sterling and HireRight.

Employer questions about running background checks legally

Can I run a background check on a current employee?

Yes, with the same FCRA steps. You need the employee's written authorization; if they signed one at hire that clearly said reports may be obtained throughout employment, the FTC says that can cover later checks. If the result may lead to discipline, demotion or dismissal, the pre-adverse and adverse notices apply to employees just as to applicants. New York City's law also covers current employees after its 2021 amendment.

Do I need to follow the FCRA if I search court records myself?

The FCRA steps in this guide apply when you get a consumer report from a consumer reporting agency. Searching public records yourself is a different situation, but the EEOC rules on fair treatment still apply, and some fair-chance laws, including New York City's and California's, limit internet searches for criminal history before a conditional offer. Ask counsel before building a do-it-yourself process.

How long should I wait after the pre-adverse action notice?

Federal law does not fix a number. FTC staff called five days reasonable in a 1997 opinion, Checkr's guide uses 7 calendar days, and New York City and California require at least five business days for criminal history decisions. Pick the longest period that applies to your locations and apply it to every candidate.

Is a background check vendor responsible for compliance?

The vendor has its own FCRA duties as a consumer reporting agency, and tools like Checkr's adverse action workflow help you send notices on time. The employer duties (disclosure, consent, the hiring decision, the waiting period and the notices) stay with you, which is why the FTC requires you to certify them when you order.

Sources and method

This is a research guide. On October 21, 2026 we read the FTC's employer guide to consumer reports, the joint EEOC and FTC guide on background checks, the EEOC's 2012 enforcement guidance on arrest and conviction records, the CFPB's Summary of Rights form, the FTC staff advisory opinion to Weisberg (June 27, 1997), the New York City Commission on Human Rights' Fair Chance Act guidance, the California Civil Rights Department's Fair Chance Act page and June 2025 fact sheet, and Checkr's pricing page, customer agreement, adverse action guide and disclosure guide. We did not open a Checkr account or run a check, and we do not rate any vendor's speed or accuracy. We also read the top-ranking how-to pages for this topic from Checkr (July 2025), Homebase (February 2026) and ScoutLogic; none gave the federal, New York City and California waiting periods side by side or priced each step. More on how we work: Saazora's research method.

Sources (checked October 21, 2026): FTC, "Using Consumer Reports: What Employers Need to Know" (last updated August 4, 2020); EEOC and FTC, Background Checks: What Employers Need to Know (March 11, 2014); EEOC, Enforcement Guidance on the Consideration of Arrest and Conviction Records (April 25, 2012); CFPB, A Summary of Your Rights Under the Fair Credit Reporting Act (September 2018 form); FTC staff, Advisory Opinion to Weisberg (June 27, 1997); NYC Commission on Human Rights, Fair Chance Act legal guidance; California Civil Rights Department, Fair Chance Act and fact sheet (June 2025); Checkr pricing page, customer agreement, "Basics of adverse action" and disclosure and authorization guides.

Research guide, not hands-on testing and not legal advice. Checkr did not pay for or review this article.