New York Financial Services Background Checks: Navigating Article 23-A, NYC Fair Chance Act, and NYDFS Requirements in 2026

Understanding New York's Layered Background Check Framework

New York financial services background checks operate within a jurisdictional framework that requires employers to identify which legal standards apply to each hiring decision. The complexity arises not from a single comprehensive statute, but from the interaction of multiple legal authorities with different scopes and requirements.

Financial institutions must first determine whether they fall under state-only jurisdiction or whether city-specific rules also apply. Employers with locations or employees in New York City face additional restrictions beyond those imposed by state law. Furthermore, entities regulated by the New York Department of Financial Services may be subject to cybersecurity personnel screening requirements that affect timing and scope of permissible inquiries.

The absence of a unified background check statute means employers cannot rely on a single compliance checklist. Instead, they must map each position to the applicable legal framework based on work location, regulatory status, and role responsibilities.

Article 23-A Statewide Protections

Article 23-A of the New York Correction Law establishes baseline fair chance protections that apply throughout the state. The law prohibits employers from denying employment based on criminal conviction history unless a direct relationship exists between the conviction and the specific employment sought, or unless hiring would create an unreasonable risk to property or public safety.

Employers must consider eight statutory factors when evaluating conviction history:

• The public policy supporting employment of individuals with conviction histories
• The specific duties and responsibilities of the position
• The bearing of the criminal offense on fitness for the position
• The time elapsed since the offense
• The age of the individual at the time of the offense
• The seriousness of the offense
• Evidence of rehabilitation
• The employer's legitimate interest in protecting property and safety

The requirement for individualized assessment applies regardless of the nature or number of convictions. Blanket policies that automatically exclude candidates based on conviction categories, offense types, or time periods generally violate Article 23-A absent specific legal authorization for categorical exclusions in particular industries or roles.

NYC Fair Chance Act Requirements

The New York City Fair Chance Act imposes additional timing and procedural requirements on employers with four or more employees that operate within city limits. These requirements apply to NYC-based positions regardless of where the employer's headquarters or parent company may be located.

Under the Fair Chance Act, employers subject to its requirements generally may not inquire about criminal history until after making a conditional offer of employment, subject to narrow statutory exceptions for specific circumstances. This timing restriction represents a significant departure from the statewide Article 23-A framework, which does not prohibit pre-offer inquiries but rather regulates how conviction information may be used in decision-making.

Once a conditional offer is made and criminal history information obtained, employers who wish to revoke the offer based on that information must follow a specific notice and response process:

• Provide written copy of inquiry results
• Identify the conviction(s) at issue
• Conduct Article 23-A analysis documented in Fair Chance Notice
• Share analysis with applicant
• Allow at least three business days for response
• Consider any timely information provided
• Hold position open during response period

Only after completing this process and waiting the required period may an employer finalize an adverse decision.

NYDFS Cybersecurity Personnel Requirements

Financial institutions regulated by the New York Department of Financial Services face an additional layer of requirements under 23 NYCRR 500, the cybersecurity regulation. This rule requires covered entities to implement cybersecurity programs that address the qualifications of personnel with access to sensitive systems. While the regulation does not mandate specific screening methods, many covered entities interpret this requirement as necessitating background verification for employees with elevated access to nonpublic information or critical systems.

The tension arises when NYDFS-supervised entities attempt to reconcile regulatory expectations for personnel screening with ban-the-box timing restrictions. An employer may face competing pressures to verify background information early in the hiring process for cybersecurity-sensitive roles while simultaneously complying with NYC's prohibition on pre-offer criminal history inquiries.

No formal guidance currently resolves this tension definitively. Some compliance approaches involve documenting the specific access level and sensitivity of the role, obtaining conditional offers before conducting criminal background inquiries, and structuring access provisioning to occur only after background verification while protecting the position during mandated response periods.

Jurisdictional Mapping for Multi-Location Employers

Financial services employers with operations spanning multiple New York jurisdictions must develop clear protocols for determining which requirements apply to each position. The controlling factors include the physical work location, the employee's assigned jurisdiction for work performance, and whether the employer maintains an NYC establishment.

For fully remote positions where the candidate will work from home within New York but outside NYC limits, the Article 23-A statewide standard applies without the additional NYC Fair Chance Act timing restrictions. However, if the employer maintains any physical location within NYC to which the employee may report or from which the employer operates, additional analysis is required.

Positions that require even occasional presence at an NYC location may trigger Fair Chance Act application. Some employers adopt the practice of applying the most restrictive standard to all New York hires to ensure compliance regardless of later work location changes or jurisdictional ambiguity.

NYC Establishment Test

The NYC Fair Chance Act applies to employers with four or more employees and a physical presence in New York City. Courts and the NYC Commission on Human Rights have interpreted "physical presence" broadly to include not only traditional offices but also co-working arrangements, storage facilities, and locations where employees regularly perform work.

An employer with headquarters outside NYC but with even a small satellite office or regular meeting space within city limits may be subject to the full Fair Chance Act framework for NYC-based hires. The four-employee threshold counts employees in any location, not just those in NYC.

Financial institutions should inventory all locations where employees perform work, including non-traditional arrangements such as vendor-provided office space or locations where client-facing staff regularly operate. This inventory informs the jurisdictional analysis for each hire and ensures appropriate procedures are followed based on actual work location.

Position-Specific Jurisdictional Analysis

Beyond employer location, certain positions may trigger different requirements based on role-specific regulatory mandates. Positions requiring Securities Industry Regulatory Authority registration, Federal Deposit Insurance Corporation approval, or other financial services licensing may involve background check requirements independent of general employment law.

These role-specific requirements do not override fair chance protections but rather add additional layers of inquiry and evaluation:

• FCRA disclosure and authorization procedures apply first
• NYC timing restrictions determine when criminal history may be inquired about
• Regulatory screening requirements determine what must be verified
• Article 23-A individualized assessment determines how information may be used

When a position requires both NYDFS cybersecurity screening and falls under NYC Fair Chance Act jurisdiction, employers typically sequence the process to obtain a conditional offer first, then conduct the required background screening, then complete the Fair Chance Act response process before finalizing employment.

The Individualized Assessment Requirement

Both Article 23-A and the NYC Fair Chance Act mandate individualized assessment of criminal conviction history rather than categorical exclusions. This requirement represents a fundamental shift from binary pass/fail background screening to a contextual evaluation process that considers the relationship between past conduct and future job responsibilities.

Individualized assessment begins with identifying the specific convictions revealed by background screening and the essential functions and responsibilities of the position. Employers must articulate what duties the position entails and how those duties relate to the conduct underlying each conviction.

The eight Article 23-A factors provide the analytical framework. Employers should document consideration of each factor with specific reference to the candidate's circumstances and the position's requirements.

Documenting the Eight-Factor Analysis

Effective documentation of the eight-factor analysis creates a contemporaneous record of the employer's reasoning and evidence considered. This documentation serves both compliance and litigation defense functions by demonstrating that the employer undertook the required individualized assessment rather than applying a prohibited blanket policy.

Generic or conclusory statements that fail to engage with the individual's actual history and the job's actual demands are insufficient and may not withstand administrative or judicial scrutiny.

Evidence of Rehabilitation

New York law places significant weight on evidence of rehabilitation when evaluating criminal conviction history. Employers must consider any rehabilitation evidence the candidate provides. Under the Fair Chance Act's response period requirement, candidates must be given at least three business days to submit such evidence after receiving notice. Under Article 23-A, rehabilitation evidence must be considered whenever it is available during the evaluation process, regardless of whether formal Fair Chance Act procedures apply.

Rehabilitation evidence may include:

• Educational achievements since conviction
• Employment history demonstrating stability
• Training or professional certifications obtained
• Community involvement and volunteer work
• Reference letters from employers, mentors, or community members
• Completion of treatment, counseling, or intervention programs
• Any other information demonstrating personal development and changed circumstances

Employers should evaluate rehabilitation evidence substantively rather than dismissing it as insufficient simply because a conviction exists. The question is not whether rehabilitation eliminates the fact of conviction, but whether it reduces the relevance of that conviction to the employment decision given the current candidate and the specific position.

Salary Transparency and Background Check Disclosures

New York State Labor Law Section 194-b and NYC Administrative Code Section 8-107 prohibit employers from inquiring about or relying on salary history in employment decisions. These salary history bans intersect with background check processes when verification of past employment includes compensation information or when candidates voluntarily disclose salary information during interviews.

Employers must instruct background check providers not to seek or report salary history information when verifying past employment. Verification should confirm dates of employment, title, and job duties without inquiring about compensation unless the candidate has voluntarily provided written authorization for salary history disclosure in compliance with the narrow exception under New York law.

When candidates voluntarily offer salary history information, employers may not use that information as a basis for screening decisions or to determine the salary offered.

Pay Transparency Notice Requirements

New York State pay transparency requirements, effective since September 2023, mandate that employers include salary ranges in job postings for positions that will or may be performed in New York. This requirement affects the background check process indirectly by establishing baseline compensation expectations before any offer stage.

Because employers must state the compensation range publicly, they cannot later claim that background check findings justify offering below the stated range to a particular candidate. The compensation offered must fall within the advertised range regardless of information learned during background screening, unless the employer makes a threshold determination not to hire the candidate at all based on permissible screening criteria.

This creates a framework where compensation is established by job requirements and market factors, not by candidate history or negotiation leverage derived from information asymmetry. Background checks may inform whether to hire but not what to pay if the hiring decision proceeds.

Cannabis Conviction Protections

New York's cannabis legalization under the Marijuana Regulation and Taxation Act includes employment protections that affect how employers may consider cannabis-related conviction history. When evaluating cannabis-related convictions, employers should consider whether the underlying conduct would remain unlawful under current New York law. Convictions for conduct that is now legal typically will not satisfy the "direct relationship" or "unreasonable risk" standards under Article 23-A absent unusual circumstances specific to the position. Each conviction should be evaluated through the individualized assessment framework.

The law recognizes exceptions for positions where federal law or federal contracts impose cannabis prohibitions, positions requiring federal background checks or security clearances, and positions where cannabis use would create safety risks under applicable federal or state safety regulations.

Distinguishing Conviction History from Current Use

The cannabis conviction protections address historical criminal records, not current cannabis use or workplace policies regarding impairment. Employers retain the ability to maintain drug-free workplace policies and to prohibit work while impaired by cannabis or any other substance.

Background checks may reveal historical cannabis convictions without creating an automatic bar to employment. Employers conducting Article 23-A analysis for such convictions should consider whether the conduct would remain unlawful under current law, whether any legal exception applies to the specific position, and whether other factors beyond the cannabis conviction itself raise legitimate concerns related to job duties.

When cannabis convictions appear alongside other criminal history, employers should evaluate each offense independently rather than treating cannabis convictions as aggravating factors that increase the significance of other offenses.

Navigating FCRA Requirements in the New York Context

New York financial services background checks must comply with both the federal Fair Credit Reporting Act and New York-specific requirements. The FCRA establishes baseline procedural requirements for consumer reports used in employment decisions, while New York law adds substantive limitations on how information may be used.

Employers must provide FCRA disclosures and obtain written authorization before procuring consumer reports for employment purposes. These disclosures must be clear and conspicuous, standalone documents not embedded within other hiring paperwork.

The timing of FCRA disclosure and authorization must align with NYC Fair Chance Act restrictions for covered positions.

Pre-Adverse and Adverse Action Requirements

When background check information will lead to an adverse employment decision, the FCRA requires pre-adverse action notice providing the consumer report and information about dispute rights, followed by a reasonable period before final adverse action, and then final adverse action notice including specific FCRA rights information.

These FCRA requirements overlap with but differ from NYC Fair Chance Act notice and response procedures. Employers subject to both frameworks should develop integrated processes that satisfy all requirements simultaneously rather than creating duplicative notice sequences.

A compliant approach for NYC positions might involve issuing a combined notice that includes:

• Consumer report copy (FCRA requirement)
• Specific conviction(s) creating concern (Fair Chance requirement)
• Article 23-A eight-factor analysis (Fair Chance requirement)
• FCRA dispute rights information
• At least three business days for response

After the response period and consideration of any information provided, final adverse action notice would include both FCRA required information and confirmation of the final Fair Chance determination.

Operational Guidance for Compliance Programs

Financial services employers should implement compliance programs that address the full spectrum of New York background check requirements through policy, training, and documentation systems. These programs must be sufficiently flexible to accommodate jurisdictional variations while maintaining consistent fair chance principles across all hiring decisions.

Policy development should begin with clear jurisdictional mapping that identifies which requirements apply to which positions. Training for hiring managers, recruiters, and decision-makers should address both technical compliance requirements and the principles underlying fair chance laws.

Technology and Process Integration

Many financial services employers use applicant tracking systems and background check platforms to manage hiring workflows. These systems should be configured to enforce jurisdictional requirements automatically based on position location and employer structure.

For NYC positions, systems can prevent criminal history inquiries until a conditional offer is generated in the platform. Integration between offer generation, background check ordering, and notice delivery systems can ensure proper sequencing and documentation.

Automated systems should not make automated adverse decisions based on background check results:

• Human decision-maker must evaluate eight Article 23-A factors
• Candidate response during Fair Chance period must be reviewed
• Technology supports through structured documentation tools and checklists
• Final judgment cannot be delegated to algorithms or automated rules

Vendor Management and Compliance Oversight

Employers who engage third-party background check providers must ensure those vendors understand and support compliance with New York requirements. Service agreements should specify the types of information to be obtained and excluded, particularly regarding salary history restrictions.

Vendors must be instructed not to report information that employers are prohibited from considering under applicable law, such as sealed or expunged records. Employers should verify that vendor search methods comply with legal restrictions on accessing and reporting protected record categories.

Regular audits of vendor compliance and output quality help identify issues before they result in violations.

Conclusion

New York financial services background checks require careful navigation of Article 23-A statewide protections, NYC Fair Chance Act timing rules, and NYDFS regulatory expectations. Employers must map each position to applicable requirements, conduct individualized assessments with proper documentation, and structure processes that respect both ban-the-box restrictions and legitimate screening needs.

Frequently Asked Questions

Can financial institutions conduct criminal background checks before making a job offer in New York City?

For most NYC positions, employers subject to the Fair Chance Act may not inquire about criminal history until after making a conditional offer of employment. Limited exceptions exist for positions where law explicitly requires background checks before conditional offers. These exceptions are narrow and jurisdiction-specific. Certain positions may be subject to regulatory background check requirements under financial services regulations that operate alongside, rather than override, Fair Chance Act procedures.

Does NYDFS cybersecurity regulation override NYC ban-the-box requirements?

NYDFS cybersecurity requirements do not explicitly override Fair Chance Act timing restrictions. Employers should structure hiring processes to issue conditional offers before conducting criminal history inquiries, then complete required screening and Fair Chance Act procedures before finalizing employment. Documentation of the specific security sensitivity of the role supports this approach.

How do New York cannabis laws affect criminal background screening for financial services positions?

When evaluating cannabis-related convictions, employers should consider whether the underlying conduct would remain unlawful under current New York law. Convictions for conduct that is now legal typically will not satisfy Article 23-A standards absent unusual circumstances specific to the position. Exceptions may apply for federally regulated positions or roles with specific safety requirements. Each cannabis-related conviction should be evaluated individually through the individualized assessment framework.

What is the difference between Article 23-A and the NYC Fair Chance Act?

Article 23-A applies statewide and requires individualized assessment of criminal convictions using eight statutory factors but does not prohibit pre-offer inquiries. The NYC Fair Chance Act adds timing restrictions prohibiting most criminal history inquiries until after conditional offers and mandates specific notice and response procedures for covered NYC employers.

Must employers document the eight-factor analysis for every candidate with criminal history?

Yes. Both Article 23-A and the NYC Fair Chance Act require individualized assessment, which necessitates documented consideration of the eight statutory factors for each candidate with conviction history when that history will inform an employment decision. Generic or conclusory documentation may not demonstrate compliance with individualized assessment requirements.

Can salary history appear in employment verification during background checks?

Employers must instruct background check providers not to seek or report salary history when verifying past employment. Verification should confirm employment dates, titles, and duties without compensation information unless the candidate has provided specific written authorization in compliance with narrow exceptions under New York salary history ban laws.

How long must NYC employers wait after providing Fair Chance Notice before making a final decision?

The NYC Fair Chance Act requires employers to provide at least three business days for candidates to respond to Fair Chance Notice before making a final adverse determination. Best practices include allowing additional time if a candidate requests it or if substantial rehabilitation evidence is submitted near the deadline.

Do New York background check requirements apply to remote positions outside NYC?

For positions where work will be performed entirely outside NYC and the employer has no NYC physical presence, Article 23-A statewide requirements apply without additional NYC Fair Chance Act restrictions. However, if the employer maintains any NYC location or the position involves even occasional NYC presence, additional analysis of Fair Chance Act applicability is warranted.

Additional Resources

1. New York State Department of Corrections and Community Supervision: Article 23-A Guidance
   https://doccs.ny.gov/article-23-licensure-and-employment-persons-previously-convicted-crime
2. NYC Commission on Human Rights: Fair Chance Act Guidance
   https://www.nyc.gov/site/cchr/law/fair-chance-act.page
3. New York Department of Financial Services: Cybersecurity Regulation (23 NYCRR 500)
   https://www.dfs.ny.gov/industry_guidance/cybersecurity
4. Federal Trade Commission: Fair Credit Reporting Act Guidance
   https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act
5. New York State Department of Labor: Pay Transparency Requirements
   https://dol.ny.gov/pay-transparency