An employer runs a background check, sees a criminal record, and sends the candidate a rejection email that afternoon. The process felt clean. The record was real. The decision was defensible.
It was also very likely a violation of federal law, and the employer will not find out until a demand letter arrives.
Two Notices, Not One
The Fair Credit Reporting Act governs how an employer may act on a background report prepared by a third party. It does not prohibit rejecting someone over what the report says. It prohibits doing it in a single step.
The required sequence has three parts, and the middle one is the part employers skip.
Step one, the pre-adverse action notice. Before making the decision final, the employer gives the candidate a complete copy of the consumer report being relied on, along with the current written summary of rights under the Fair Credit Reporting Act published by the Consumer Financial Protection Bureau. The full report, not a summary the employer wrote, and not a description of what the report said.
Step two, the waiting period. The candidate gets a reasonable opportunity to review the report and dispute inaccuracies with the consumer reporting agency that produced it. The statute does not define reasonable in days, which is precisely why this step gets compressed. Industry practice has settled on five business days as a defensible floor.
Step three, the final adverse action notice. Only after the waiting period has actually elapsed. It tells the candidate the decision was made, identifies the consumer reporting agency, states that the agency did not make the decision and cannot explain it, and notifies the candidate of the right to a free copy of the report and the right to dispute its accuracy.
The most common violation is not skipping a notice. It is sending both notices within twenty four hours. A waiting period that does not allow time to obtain and review a report, contact the agency, and file a dispute is not a waiting period. The paperwork being technically complete does not cure it.
State Law Is Tightening the Floor
Because the federal statute leaves the duration open, states have begun setting their own. Washington's Fair Chance Act imposes a two day waiting requirement on employers with fifteen or more employees beginning in July 2026.
For a multi state employer this creates the familiar problem: the compliant process is the strictest one that applies to any candidate in the pipeline. Running a single national standard at five business days is simpler than tracking which candidate sits in which jurisdiction, and it clears every current state floor.
What the Waiting Period Is Actually For
The compliance framing makes this sound like a formality to document. It is not. Consumer reports contain errors at a meaningful rate, and the candidate is the only person in the transaction positioned to identify them. The screening vendor cannot. The employer cannot. Only the person whose life the record describes knows whether it is accurate.
Three errors account for most of what we see.
Identity collisions. A record belonging to a different person, matched on a common name and a partial date of birth. This is the single most frequent error, and it is most likely to affect candidates with common surnames. A record attached to the wrong person reads exactly like a record attached to the right one.
Expunged and sealed records that still surface. A court ordered the record sealed, but the sealing did not propagate to every database the vendor pulls from. The candidate typically knows the disposition and can produce the order. Nobody else in the process can.
Date compression. A charge from eleven years ago appears with a recent date, because the reported date is when the record was digitized rather than when the underlying event occurred. That distinction can decide whether the item is even reportable under the seven year rule, and whether it is relevant to the role at all.
Every one of these is correctable. None of them are correctable after a rejection email has already gone out.
What a Compliant Process Looks Like in Practice
Set a single waiting period and apply it to every candidate regardless of location. Five business days is the working standard, and consistency is itself a defense.
Send the complete report. Attaching the actual document is less work than summarizing it and it is what the statute requires.
Include the current summary of rights. It is revised periodically, and using a version from several years ago is an avoidable defect.
Give the candidate a name and a way to respond. A notice that arrives from a no reply address, with no path back to a human, is technically a notice and practically a dead end.
Document the dates. The date the pre-adverse notice was sent, the date the waiting period expired, and the date the final notice was sent. Three dates in a file are what demonstrates the process was followed, and reconstructing them later is not possible.
Decide in advance what you do when a candidate disputes. Most employers have no answer, and the result is an application that sits untouched while the dispute resolves and the candidate takes another offer.
The Argument That Is Not About Compliance
Every part of this can be justified on legal exposure alone, and that argument is real. It is also the weaker one.
The stronger argument is that the waiting period is where you find out the record was not theirs. Employers who compress the process do not merely take on legal risk. They quietly lose qualified candidates to somebody else's criminal history, and they never learn it happened, because the person they rejected had no way to tell them.
The candidate you were about to lose over a name collision is still available on day five.