What Happens After a Failed Background Check: A 2026 Employer's Action Plan

Most employer guides cover the easy part: disclosures, consent forms, which screening package to order. Very few prepare you for the decision window that opens the second results come back with a hit. That window is where careers get decided — and where lawsuits get born.

According to the Professional Background Screening Association (PBSA) and HR.com annual survey, 93 to 96 percent of U.S. employers conduct background checks. According to the EEOC's Enforcement Guidance on Arrest and Conviction Records, 92% of surveyed employers said they subject all or some candidates to criminal background checks.

The exposure is personal: willful FCRA violations carry statutory damages of $100 to $1,000 per violation, plus punitive damages and attorney's fees (Cornell Law, 15 U.S.C. § 1681n). Because those amounts stack per person, per violation, they add up fast.

As of 2019, more than 40 employers had paid $1 million or more to settle FCRA employment claims, including Wells Fargo's $12 million and Target's $8.5 million (Good Jobs First).

Here's the sequence that keeps you on the right side of that line.

What a "Failed" Background Check Actually Means

The phrase itself causes most of the damage. As Checkr puts it, a failed background check isn't an automatic disqualification — it means the report returned hits or alerts that a human needs to review.

Those hits vary widely:

Criminal history, including felonies, misdemeanors, and convictions
Employment discrepancies, such as job titles or dates that don't match
Education discrepancies, like degrees a school can't verify
Driving-record problems, including suspended licenses and violations
Failed drug tests

A suspended license from three years ago and a mismatched job title aren't remotely the same problem, yet both land in the same inbox. What matters is that the moment you act on any of them, the FCRA's adverse-action machinery switches on, whether or not you call it an adverse action.

Adverse Action Covers More Than Rejecting a Hire

Adverse action means any negative employment decision based "in whole or in part" on a consumer report, per the FTC. That includes refusing to hire, denying a promotion or reassignment, terminating someone, or cutting their responsibilities or pay.

A 2026 DISA walkthrough of the process also notes it reaches contractors and temporary workers, not just full-time employees.

The misconception that trips people up is treating adverse action as a hiring-stage thing. It isn't. Order a check on an existing employee and move them off a customer-facing account because of what it says, and you've triggered the same notice obligations.

The FCRA Two-Step Process — and the Waiting Period That Trips People Up

Step 1 — Pre-Adverse Action Notice

Before any final negative decision, send a pre-adverse action notice. It has to contain two things: a copy of the consumer report you relied on, and the CFPB's "A Summary of Your Rights Under the Fair Credit Reporting Act." The FTC's employer guidance spells out both, and the EEOC's "Background Checks: What Employers Need to Know" echoes the requirement.

The point isn't paperwork for its own sake. It gives the candidate time to read the report, spot an error, and explain context or rehabilitation evidence before your decision hardens.

The "Reasonable" Waiting Period

The FTC recommends employers wait at least five business days between the pre-adverse and final notices, a benchmark the DISA guide lays out. States add their own floors: California requires at least five business days after confirmed receipt, and New York City keeps the job open for five business days. Multi-state employers have to track those variations, not average them.

And if the candidate disputes with the consumer reporting agency during that window, everything pauses. The CRA gets 30 days to reinvestigate — 45 if the candidate submits extra information.

Step 2 — Final Adverse Action Notice

Once the waiting period closes and any dispute resolves, send the final adverse action notice. Per the FTC, it tells the applicant four things:

The decision was based on information in the report
The name, address, and phone number of the company that supplied it
That the reporting company didn't make the decision and can't explain it
That the candidate can dispute accuracy and get another free report within 60 days

One watch-out shows up in case after case: language implying the screening vendor rejected the candidate. "The vendor flagged you" reads like the CRA made the call. It didn't. You did.

The EEOC Layer — Individualized Assessment and the Green Factors

Why Blanket Bans Are Legally Dangerous

Nothing above says you can't reject someone over a conviction. It says you can't reject everyone with any conviction, automatically.

The EEOC's Enforcement Guidance on the Consideration of Arrest and Conviction Records is explicit: a policy that permanently excludes anyone convicted of anything beyond a minor traffic offense isn't consistent with business necessity under Title VII.

Arrests get even less room. "The fact of an arrest does not establish that criminal conduct occurred," and an exclusion based on an arrest alone isn't job related. You can act on the underlying conduct if it makes someone unfit for the role — but not on the arrest itself.

The Three Green Factors

Targeted screening traces back to Green v. Missouri Pacific Railroad (1977), and the EEOC recommends using a targeted criminal-record screen guided by these three 'Green factors,' followed by an opportunity for individualized assessment:

The nature and gravity of the offense or conduct
The time since the offense or completion of the sentence
The nature of the job held or sought

A 12-year-old shoplifting conviction for a warehouse role is a different calculation from a recent fraud conviction for a finance job. The factors force that comparison into writing.

Individualized Assessment in Practice

Screen someone out on a conviction and the EEOC expects three steps: tell them the conviction is why, give them a real chance to show why the exclusion shouldn't apply, and genuinely weigh what they tell you. Some jurisdictions require it outright — Los Angeles, New York City, and Chicago, whose amended Ban the Box ordinance took effect in April 2023 with strict written-analysis requirements.

Why Fair-Chance Screening Is Also a Talent Strategy

Roughly 77 million U.S. adults, about 1 in 3, have a criminal record, a widely reported estimate. Blanket disqualification walls off a third of the workforce. Retention tends to run higher among employees hired with records, and a Yale audit study found employers conducting background checks were 63% more likely to call back a candidate without one.

Policy has followed the same logic. NELP's Fair Chance Hiring Guide counts 37 states, Washington, D.C., and 150-plus cities and counties with ban-the-box or fair-chance rules, plus 15 states requiring private employers to drop conviction questions from applications — more than 267 million people live under some form of fair-chance policy.

The EEOC's own guidance, leaning on 2010 arrest data and national data cited in the EEOC's Enforcement Guidance to explain disparate impact explained why: in 2010, 28% of all arrests were of African Americans even though African Americans comprised approximately 14% of the general population.

The DOJ estimated that 1 in 3 African American men, 1 in 6 Hispanic men, and 1 in 17 White men will go to prison at some point in their lifetime — blanket exclusions fall unevenly by race and national origin, which is the disparate-impact hook.

The Dispute Window

After the pre-adverse notice goes out, the candidate can dispute the report with the CRA. The agency has 30 days to reinvestigate — 45 if new information arrives — and your process stops until it finishes.

That pause matters more than it sounds. The CFPB's January 2024 guidance on inaccurate background check reports flagged the recurring failure modes: expunged, sealed, or legally restricted records showing up anyway, arrests listed without dispositions, and duplicate entries. The guidance is from early 2024, and the CFPB withdrew it in May, 2025, but the FCRA accuracy duties still apply.

Treat the dispute window as risk prevention rather than administrative delay. It's your last clear chance to avoid a wrongful-rejection claim built on bad data.

The Mistakes That Keep Producing Million-Dollar Settlements

The enforcement record explains why the sequence matters. Over the decade prior to 2019, employers paid $174 million to resolve 146 FCRA class actions tied to background-check decisions, and screening providers paid another $152 million when sued directly (Good Jobs First — dated figures, but the most recent of their kind from that tracker).

The pattern behind those numbers is remarkably repetitive:

Auto-rejecting on a flag without sending a pre-adverse notice
Sending the notice without the full report or the rights summary attached
Same-day pre-adverse and final notices, with no reasonable waiting period
Never sending a final notice at all
Language suggesting the screening company made the decision
Finalizing while a dispute is still open
Applying different criteria to similarly situated candidates
Using non-CRA data without FCRA procedures

There's a form-version trap in there too. Starting March 20, 2024, a revised summary of consumer rights became mandatory, and distributing the outdated version is itself a violation — one a side-by-side comparison of documents proves.

None of these are judgment calls. They're process failures, and a single defective template applied to hundreds of candidates turns one mistake into a class action.

Building a Repeatable, Auditable Workflow

Here's the uncomfortable truth about FCRA class actions: the trigger is usually one defective template reused across hundreds or thousands of candidates. Fix the template, document the process, and most of the exposure disappears.

A defensible workflow looks like this:

A written adverse-action policy applied the same way every time
A pre-adverse template that always includes the full report and the current rights summary
A documented waiting period with an audit trail — notice sent, notice confirmed, final notice sent
A pause mechanism that fires whenever a dispute is filed
Individualized-assessment notes logged per candidate, with nature-time-nature reasoning

If your documented hiring workflow lives in someone's inbox — notices attached by hand, timing tracked in a spreadsheet, decisions explained out loud — your risk concentrates in exactly the places lawsuits target: inconsistent timing, missing attachments, and reasoning nobody wrote down. Standardize first, then document. Not the other way around.

Caveats, Counterpoints & Jurisdictional Complexity

Two caveats before you rewrite your policy. First, none of this is legal advice, and the FCRA and EEOC frameworks are federal floors — states and cities can demand longer waiting periods, mandatory written analysis, or limits on when you may run a check at all.

Second, even a fully automated workflow can be challenged if you apply criteria inconsistently or the underlying CRA data is wrong. Multi-state employers carry the heaviest load: a process that's compliant in one state can be plainly insufficient in the next.

The Decision Window Is Where You Win or Lose

The moment adverse results appear is the moment most employers rush — and rushing is what generates the settlements. The lowest-exposure employers aren't the ones that screen hardest. They're the ones that decide consistently, document everything, and treat individualized assessment as a real step rather than a formality.

So audit your post-report workflow. Check it against the two-step FCRA notice, the EEOC's individualized-assessment framework, and your own jurisdiction's rules. If that workflow lives in somebody's inbox right now, the liability compounds with every candidate you screen.