Issue 45 | August 10, 2026


Background Checks: More Rules, More Risk

For years, the Fair Credit Reporting Act (FCRA) presented the principal compliance concern for employers running criminal background checks through third-party and online vendors. (Note: Different rules beyond the scope of this Monday Minute apply to employers mandated to conduct fingerprint checks through state or federal authorities.)


A growing patchwork of state and local laws has since developed, however, creating different rules depending on where the employee is located. These rules may govern what a background report can contain, when an employer can ask about criminal history, and how the results can be used.


Alongside FCRA’s limits on what a background report may disclose, “Ban the Box” laws impose further restrictions during the hiring process. Below is a guide to the requirements that matter most:


Look-Back Periods


Federal Law. FCRA bars consumer reporting agencies from reporting most adverse items of information older than seven years. Criminal convictions are the key exception: they may be reported indefinitely, and federal law does not limit how far back an employer may consider them.


Salary Exemption. FCRA’s seven-year reporting limits also do not apply when the position’s annual salary equals, or may reasonably be expected to equal, $75,000 or more. 


State and Local Law. Most states track FCRA’s framework but layer additional limits on top of it.


Unlike FCRA, state and local laws commonly impose a seven-year look-back period for criminal convictions. They may also set a shorter look-back period for – or exclude entirely – expunged, juvenile, or misdemeanor records. Many also prohibit consideration of records of arrests that did not result in conviction, with the exception of currently pending charges. Convictions arising from conduct that has been decriminalized may also be excluded (e.g., marijuana use). 


FCRA Notice and Authorization Requirements


Content limits are only half of the exposure. FCRA’s procedural requirements generate most background check litigation, and they are easy to violate. These include:


  • Before obtaining a report, provide a clear and conspicuous written disclosure in a standalone document – no liability waivers, no additional state notices, nothing else on the page – and obtain the applicant’s written authorization.
    
  • Before taking adverse action, provide a pre-adverse action notice with a copy of the report and the Consumer Financial Protection Bureau’s Summary of Rights, then allow a reasonable period to respond.
    
  • After the decision, send a final adverse action notice identifying the reporting agency and the applicant’s right to dispute the report’s accuracy.


Ban the Box


An increasing number of states and localities have enacted “Ban the Box” laws that restrict when an employer can legally inquire into an applicant’s criminal history. Depending on the jurisdiction, inquiries may be permitted only after: (1) an initial application is submitted; (2) the first interview is conducted; or (3) a conditional offer of employment is extended. 


Local Ban the Box ordinances may be more restrictive than state law. For example, Maryland law prohibits criminal inquiries until after the first in-person interview and only reaches employers above a specified headcount; however, Montgomery County, Prince George’s County, and Baltimore City prohibit inquiries until after a conditional offer of employment. 


Ban the Box typically does not apply to industries where initial background checks are mandated by state or federal law (e.g., positions working with minors or vulnerable adults). Employers with fewer than a specified number of employees may also be exempt. 


EEOC Guidance


The Equal Employment Opportunity Commission (EEOC) offers guidance for employers when reviewing an applicant’s background report:


  • Denials based on someone’s background report should be job related and consistent with business necessity, measured by the nature of the offense, the time elapsed since it occurred, and the nature of the job sought. 
    
  • Watch for screening criteria that disproportionately exclude applicants of a particular race, national origin, sex, religion, disability, or age – a seemingly neutral policy can still create unlawful disparate impact. 
    
  • Give the applicant an individualized opportunity to explain negative information before the decision becomes final, and document that assessment. 


In addition to complying with EEOC guidance, additional state or local obligations likely exist. For example, some states require a substantial relationship between the offense and the job sought. Other states may require an initial notice of denial, a time period in which the position is kept open for the applicant to provide evidence of good conduct, and a final notice of denial. 

 

Practical Steps

  • Confirm whether your jurisdiction’s Ban the Box law applies to employers of your size, at what stage you may inquire, and what applicants are not obliged to disclose on an initial application. 
    
  • Ask your background check vendor to confirm that its reports apply the look-back limits of every state and locality where you hire, not merely FCRA’s. 
    
  • Audit your disclosure and authorization forms for standalone compliance, and document an individualized assessment for every adverse decision. Some states require additional notices and response periods for denials.


If you have questions about these requirements and how to mitigate risk, please reach out to:

Steve Metzger

Email

Rommel Loria

Email
 

View all of our Monday Minute issues here.

 
 

About Our Firm

For 65 years, Gallagher has been a trusted partner to businesses and non-profits across the Mid-Atlantic region and nationwide. We represent leading universities, hospitals, financial institutions, real estate developers, and more. Our firm is experienced in a wide range of practice areas, including real estate development, affordable housing, civil litigation, confidential investigations, healthcare, employment law, corporate law, renewable energy, and tax-driven transactions. We pride ourselves on offering innovative, practical solutions with a personal touch, acting as your partner and trusted advisor. With a deep commitment to seeing challenges from every angle, Gallagher is here to help you navigate the complex legal landscape with confidence. For more information, visit www.GallagherLLP.com.

 
 
Facebook  LinkedIn

650 S Exeter Street Suite 1200 | Baltimore, MD 21202 US