Adverse action is the single most legally exposed moment in the background screening process, and it is also the moment that decides whether a candidate walks away trusting your organization or filing a complaint against it. A background report has returned findings on a live candidate. A hiring manager wants an answer. The law requires a precise sequence before any final decision, and the sequence changed in several jurisdictions in 2026. This guide walks through the federal requirements step by step, explains what state and local fair chance laws add, and covers the June 2026 federal enforcement shift that most published guidance has not yet caught up with.
This guide draws on FTC and CFPB guidance, federal statute, state statutes and agency resources, and the GCheck 2026 Trust in Hiring Report, a survey of 1,500 U.S. workers. It is written for HR and talent acquisition leaders who own the screening workflow, and it is current as of July 2026. It explains the law for educational purposes and does not constitute legal advice; consult employment counsel for decisions about specific situations.
What is adverse action in a background check?
Adverse action in a background check is any employment decision that negatively affects a candidate or employee and that is based, in whole or in part, on information in a consumer report from a third-party screening provider. Denying a job application, rescinding a conditional offer, denying a promotion, and terminating employment all qualify. Before any of these decisions becomes final, the federal Fair Credit Reporting Act requires the employer to follow a specific two-notice process that gives the person a chance to see the report and respond.
The term carries different meanings in other legal contexts, which is worth one sentence of disambiguation. In credit and lending, an adverse action notice is what a lender sends when denying credit under the Equal Credit Opportunity Act and the FCRA’s credit provisions. In discrimination and retaliation law, an “adverse employment action” describes conduct that can support a Title VII claim. This guide covers the employment screening meaning: the process an employer must run before acting on a background check.
The process exists because background check data can be wrong. Reports sometimes contain identity mismatches, sealed or expunged records, or records that belong to a different person entirely. The two-notice sequence is the mechanism that lets a candidate catch those errors before they cost a job. In the GCheck 2026 Trust in Hiring Report, 77 percent of workers said the ability to review or dispute findings would increase their confidence in an employer’s background check. Adverse action is where that stated preference either gets honored or gets ignored.
What are the steps in the FCRA adverse action process?
The FCRA adverse action process has five steps, and the order matters as much as the contents. FTC guidance for employers describes the required sequence, and every step should be documented as it happens.
- Review the findings before deciding. Evaluate the report against a consistent, job-related standard. Do not finalize anything yet; the law requires that the decision remain genuinely open through the next three steps.
- Send the pre-adverse action notice. Give the candidate a written notice that adverse action is being considered, a complete copy of the consumer report, and the current version of the CFPB document titled A Summary of Your Rights Under the Fair Credit Reporting Act.
- Wait a reasonable period. Hold the position and the decision open so the candidate has a real opportunity to review the report, dispute inaccuracies, or provide context. The waiting period rules are covered in detail below because they vary by jurisdiction.
- Consider anything the candidate provides. If the candidate disputes the report’s accuracy with the screening company, the screening company must reinvestigate, generally within 30 days under the FCRA. The employer should pause the sequence while a reinvestigation is pending and should weigh any context or evidence the candidate submits directly.
- Send the final adverse action notice if proceeding. If the decision still stands after the waiting period and any response, send the final notice with the contents the FCRA requires, listed in a later section of this guide.
Run correctly, this sequence produces a complete documented record: what was considered, what the candidate was told, when each notice went out, and how any response was handled. That record is what makes the decision defensible in an audit or a lawsuit, and building it is Transparent Compliance in practice.
What must a pre-adverse action notice include?
A compliant pre-adverse action notice package includes the following items under federal law, and several jurisdictions add more:
- A statement that the employer is considering adverse action based in whole or in part on the consumer report
- A complete copy of the consumer report itself, and a summary is insufficient
- The current CFPB Summary of Your Rights Under the Fair Credit Reporting Act
- Instructions for how the candidate can dispute the report with the screening company and how to respond directly to the employer
- Any state or locally required notices, and in some jurisdictions the notice must identify the specific record at issue and include an individualized assessment or a jurisdiction-specific summary of rights
One trap catches otherwise careful employers: form version currency. The CFPB updated the Summary of Rights and made the new version mandatory as of March 20, 2024, and the current English and Spanish versions live on the CFPB’s model forms page. A pre-adverse action letter that attaches an outdated Summary of Rights is a defective notice, and defective forms are among the most common allegations in FCRA class actions. Whoever owns your adverse action letter template also owns checking that page.
GCheck maintains a free FCRA adverse action letter template that reflects the current federal requirements, linked in the References below. Workers have told us why the notice contents matter: 82 percent want a clear explanation of what is being checked, according to the GCheck 2026 Trust in Hiring Report. A pre-adverse notice written in plain language does the legal job and the human one at the same time.
How long must an employer wait between the pre-adverse and final adverse action notices?
The honest federal answer is that the FCRA requires a “reasonable” waiting period and does not fix a number of days. Five business days is the widely accepted convention, grounded in FTC staff guidance and case law and reflected in SHRM’s employer guidance, and some practitioners advise seven calendar days as a conservative cushion. Treat five business days as the federal floor in practice, then check whether a state or local law raises it.
As of July 2026, the jurisdictional floor-raisers that most often apply are:
- California. The Fair Chance Act, at Government Code section 12952, requires at least five business days for the candidate to respond to the preliminary notice, plus five additional business days if the candidate disputes the accuracy of the conviction history report and is gathering evidence.
- New York City. The Fair Chance Act process requires the employer to share its written individualized analysis on the required form and hold the position open for at least five business days while the candidate responds.
- Philadelphia. The amended Fair Criminal Record Screening Standards Ordinance, effective January 6, 2026, requires employers to give the candidate ten business days to submit evidence of inaccuracy or an explanation before any final adverse decision.
- Washington State. The amended Fair Chance Act, enacted as HB 1747 and effective July 1, 2026 for employers with 15 or more employees, requires holding the position open at least two business days after the pre-adverse notice; when the state process is folded into the FCRA sequence, the combined waiting period runs at least five business days. Smaller Washington employers must comply beginning January 1, 2027.
- Illinois. The Human Rights Act’s criminal conviction provisions require an individualized assessment and give the candidate at least five business days to respond to the employer’s preliminary notice.
One operational point matters more than any specific number. The waiting period only protects the employer if the decision genuinely stays open during it. Marking the candidate rejected in the ATS on day one and mailing the final notice on day six is a paper compliance exercise that discovery will expose.
What must a final adverse action notice include?
The final adverse action notice must contain five elements under the FCRA:
- A statement of the adverse action taken
- The name, address, and phone number of the screening company that furnished the report
- A statement that the screening company did not make the decision and cannot explain the specific reasons for it
- Notice of the candidate’s right to obtain a free copy of the report from the screening company within 60 days
- Notice of the candidate’s right to dispute the accuracy or completeness of the report with the screening company
Some jurisdictions add contents to the final notice as well. Washington’s amended law, for example, requires a written decision that documents the employer’s reasoning and its assessment of the individualized factors, and California’s final notice must describe any internal reconsideration procedure and the right to file a complaint with the Civil Rights Department.
Documentation obligations continue after the notice goes out. Keep dated copies of both notices, the report, the Summary of Rights version used, the individualized assessment, and the disposition of any dispute. When records containing consumer report information are eventually discarded, the FTC’s Disposal Rule requires secure disposal. An audit trail that can be produced on demand is the difference between an uncomfortable records request and a settlement negotiation.
What should happen during the adverse action waiting period?
During the waiting period, the candidate can take one of three paths, and each one is the system working as designed.
- The candidate disputes the report. The screening company must reinvestigate, generally within 30 days under the FCRA. The employer’s sequence should pause automatically until the reinvestigation resolves, because acting on information that is under formal dispute defeats the purpose of the process.
- The candidate provides context. Evidence of rehabilitation, proof that a record was expunged or sealed, documentation of an identity mismatch, or an explanation of circumstances all feed the individualized reconsideration that several state laws require and that good judgment recommends everywhere.
- The candidate does not respond. After the applicable period ends, the employer may proceed to the final notice.
The employer’s job during this window is restraint. Do not fill the role, do not tell the team the search is over, and do not treat silence in the first 48 hours as a waiver. Screening data can contain errors, so the pause protects the candidate from a mistake and protects the employer from acting on one. A candidate who corrects a wrong record during this window is a qualified hire the process almost lost.
When is the adverse action process required, and when is it not?
The adverse action process is required whenever information from a third-party consumer report influences a negative employment decision, even partially. The scope rulings practitioners ask about most often come down to these:
- Required for any report content. The process applies to anything in the report that influences the decision, including employment verification discrepancies, license issues, and driving records; criminal history is only the most common trigger.
- Required for contractors and volunteers. If a screening company prepares the report, the FCRA process applies to independent contractors and volunteers being screened, and prudent employers run the same sequence for them.
- Required when the report is only part of the reason. “In part” is the statutory standard, so pairing report findings with other concerns does not remove the obligation.
- Not triggered when no report exists. If the candidate declines to authorize the check, there is no consumer report and no adverse action process; the employer may simply be unable to move forward.
- Not triggered when the candidate withdraws first. A candidate who exits the process before any decision has not experienced adverse action.
- Not triggered by purely internal information. Decisions based solely on information the employer gathered itself, without a screening company, fall outside the FCRA process, though fair chance laws in many places still regulate how criminal history can be used, and transparency remains good practice.
Does the adverse action process apply to current employees?
Yes. The adverse action process applies to current employees whenever consumer report information drives a promotion denial, reassignment, retention decision, or termination. This makes the process central to any post-hire screening or continuous verification program: every rescreen that surfaces new information can trigger the full two-notice sequence.
The bar for post-hire handling rose in 2026. Philadelphia’s amended ordinance and Washington’s amended Fair Chance Act both extend their protections explicitly to current employees and internal moves, which means the individualized assessment and waiting period obligations follow the person throughout employment in those jurisdictions. Workers broadly support the underlying practice: 80 percent say ongoing or periodic screening is important, according to the GCheck 2026 Trust in Hiring Report. Continuous verification keeps compliance current across the employee lifecycle, and running the adverse action process properly on post-hire findings is what keeps that verification fair rather than fearful.
How do state and local fair chance laws change the adverse action process?
The FCRA is the national floor, and 37 states plus more than 150 cities and counties have layered fair chance or ban-the-box requirements on top of it. Rather than cataloging every jurisdiction, it helps to understand the categories of obligation the overlays add:
- Later timing of criminal inquiries. Many laws prohibit asking about or checking criminal history until after a conditional offer, with Washington joining that group in 2026.
- Individualized assessment with written analysis. New York City and California require a documented job-relatedness analysis, and NYC requires sharing the completed analysis form with the candidate.
- Record-specific notice content. Several jurisdictions require the notice to identify the exact conviction being considered, and Philadelphia’s 2026 amendments added a required summary of rights and a statement inviting evidence of error or rehabilitation.
- Longer response windows. Philadelphia’s ten business days and California’s five-plus-five structure both exceed the federal convention.
- Restrictions on what can be considered at all. Common limits cover arrests without conviction, juvenile records, older convictions, and sealed or expunged records; Philadelphia now bars consideration of summary offenses and misdemeanors older than four years.
- Clean-slate sealing. A growing set of states automatically seals qualifying records, which removes them from reports entirely and makes stale data in a screening database a liability.
The 2026 changes in Philadelphia and Washington illustrate the real lesson: this landscape moves every year, and an adverse action process built once and run from memory rots quietly until a complaint reveals it. Multi-state and remote hiring make jurisdiction-aware workflow logic an operational requirement rather than a nice-to-have, and maintaining that logic is a core test of any screening platform.
What is an individualized assessment, and do employers still need one in 2026?
An individualized assessment is a job-specific review of whether a candidate’s record actually matters for the role, weighing the nature and gravity of the offense, the time elapsed since it, and its relevance to the specific position, along with context the candidate provides, instead of applying a blanket exclusion. The practice was historically anchored in the EEOC’s 2012 enforcement guidance on arrest and conviction records under Title VII.
The federal posture changed in 2025 and 2026, and this guide reports the change factually. Executive Order 14281, issued in April 2025, directed federal agencies to deprioritize disparate-impact liability. On June 9, 2026, the Department of Justice’s Office of Legal Counsel issued a formal opinion concluding that the EEOC’s disparate-impact guidelines under Title VII are unconstitutional, and the EEOC’s current enforcement plan prioritizes intentional-discrimination claims over disparate-impact theories. Federal enforcement built on the 2012 guidance has, as a practical matter, receded.
Three things did not change, and they answer the question employers are actually asking:
- The DOJ opinion does not carry the force of law, does not amend Title VII, and does not by itself rescind the 2012 guidance, which as of July 2026 remains published on the EEOC’s site. Disparate impact remains codified in Title VII through the Civil Rights Act of 1991, and private plaintiffs can still bring those claims under existing case law.
- State and local law independently requires individualized assessment regardless of federal enforcement posture. California, New York City, Illinois, Washington, and Philadelphia all mandate some form of it, with several requiring written documentation.
- Consistency remains the defensibility standard everywhere. A documented, uniform assessment framework is what demonstrates that decisions were job-related rather than arbitrary.
So the practical answer for 2026 is yes, keep doing individualized assessments. State law requires them in the jurisdictions where most enterprise hiring happens, private litigation exposure remains, and individualized review applied through one consistent framework is also what workers say fairness looks like: 75 percent want consistent screening standards applied to every candidate, per the GCheck 2026 Trust in Hiring Report. Individualization and consistency are complements. The framework stays the same for everyone; the framework itself considers the person.
What happens if an employer skips or botches the adverse action process?
The exposure is statutory, and it multiplies. For willful FCRA violations, a candidate can recover statutory damages of 100 to 1,000 dollars per violation without proving actual harm, plus punitive damages and attorney’s fees, under 15 U.S.C. section 1681n. Negligent violations carry actual damages and fees under section 1681o. Because adverse action failures tend to be systemic, affecting every candidate who went through the same broken workflow, they are natural class actions, and a class of a few thousand applicants turns a per-person statutory range into a seven-figure demand.
The volume trend points one direction. FCRA lawsuit filings grew more than 37 percent in 2025 compared with 2024, according to WebRecon data reported by the Consumer Financial Services Law Monitor, and filings continued climbing into 2026. A law firm survey published in 2021 found that employers had paid more than 150 million dollars over the preceding decade to settle nearly 150 FCRA class actions, and plaintiff firms continue to actively recruit adverse-action plaintiffs.
Two failure modes account for most employer liability:
- Defective disclosure and notice forms, including outdated Summary of Rights versions and disclosure documents that violate the standalone requirement.
- Skipped or rushed pre-adverse action steps, most often sending the final decision without a real waiting period, or never sending the pre-adverse notice at all.
Both patterns share a root cause. Most violations are process failures under time pressure rather than deliberate misconduct: a recruiter working from an old inbox template, a manager who finalized the rejection before legal saw the file. That diagnosis points to the fix. A sequence this exacting should be built into the screening workflow, with current forms, jurisdiction-aware timers, and automatic documentation, rather than reconstructed from memory each time a report comes back with findings.
Should the adverse action process be automated or human-reviewed?
Both, in different places, and the split is becoming the industry standard. Automation belongs in the sequence: generating notices with the current federal and jurisdiction-specific forms, running jurisdiction-aware waiting-period timers, pausing automatically when a dispute triggers reinvestigation, and logging every step for the audit trail. Humans belong in the judgment: whether a record is genuinely job-related, how to weigh the context a candidate provides, and the final decision itself.
Workers have been explicit about where they want people in the loop. In the GCheck 2026 Trust in Hiring Report, 81 percent of workers said they want humans to review findings rather than leaving decisions to fully automated systems, and 74 percent want transparency about how AI or automation is used in screening. Regulators are converging on the same two questions as state AI-in-hiring rules mature: where does automation operate in your process, and at what point does a person review before a decision finalizes. An employer who can answer both plainly holds a compliance posture and a trust posture at once, which is Protective Compliance and Transparent Compliance working together.
What does the candidate experience during adverse action, and why does it matter?
Consider the sequence from the candidate’s side. They were close to a job, possibly holding a signed offer, and then a letter arrived saying a background report may take it away. What happens in their mind next depends entirely on three things: whether the notice explains the situation in plain language, whether the dispute path visibly works, and whether a human being is reachable.
Report errors are a documented reality, from identity mismatches to records that were sealed or belong to someone else, so a candidate exercising dispute rights is often correcting the record rather than gaming the process. The employer who treats that response as the fairness mechanism working keeps qualified candidates it would otherwise lose, and it protects an employer brand that a template-driven silent rejection would quietly damage. The GCheck 2026 Trust in Hiring Report found that 77 percent of workers want a path to review or dispute findings and 82 percent want a clear explanation of what is being checked; adverse action is the moment both preferences are tested under the worst possible circumstances.
For the full standard on communication, timelines, and dignity across the entire screening journey, see our companion guide, What a Great Candidate Experience Looks Like in Background Screening. This article goes deep on the adverse action procedure; that one covers the experience surrounding it.
What questions should HR ask a screening vendor about adverse action support?
The compliant sequence involves current forms, jurisdiction logic, pause conditions, and documentation, which makes vendor workflow quality a direct compliance variable. These eight questions belong in any screening RFP or renewal conversation:
- Does the platform automate the two-notice sequence with jurisdiction-aware waiting periods, including the 2026 changes in Philadelphia and Washington?
- How are state and local notice requirements maintained, and how quickly are legal changes reflected in production workflows?
- Does a candidate dispute automatically pause the sequence, and what does the reinvestigation workflow look like end to end?
- Which version of the CFPB Summary of Rights ships in notices today, and who owns keeping it current?
- What documentation and audit trail exist for every step, and can they be exported on demand?
- How does the platform support individualized assessment, including structured intake of candidate responses and context?
- Where do humans review findings before decisions finalize, and how is that review documented?
- If a notice turns out to be defective, how does the vendor support remediation? Ask this one knowing the honest baseline: the legal obligation for adverse action stays with the employer, which is exactly why the quality of the workflow the vendor provides matters so much.
A vendor’s answers to these questions reveal whether adverse action is engineered into the platform or left as a manual exercise for your team. If the topic comes up, it is also reasonable to ask any vendor about their PBSA accreditation status as one signal of professional standards in the screening industry.
The takeaway for employers
Adverse action is where the trust deficit in hiring either compounds or reverses. Run as a silent, template-driven rejection, it confirms every fear candidates bring to a background check and stacks legal exposure at the same time. Run as the law intends, with a transparent notice, a genuine chance to be heard, and a human making the final call through one consistent framework, it becomes the strongest proof an organization can offer that its screening is fair. The sequence is exacting, the jurisdictional overlays keep moving, and 2026 has already rewritten the rules in two major markets. Employers who build the process into their workflow, rather than running it from memory, protect their candidates and themselves in the same motion.
References
Federal Trade Commission. Using Consumer Reports: What Employers Need to Know. https://www.ftc.gov/business-guidance/resources/using-consumer-reports-what-employers-need-know
Federal Trade Commission. Background Checks: What Employers Need to Know. https://www.ftc.gov/business-guidance/resources/background-checks-what-employers-need-know
Consumer Financial Protection Bureau. Model Forms and Disclosures (A Summary of Your Rights Under the Fair Credit Reporting Act). https://www.consumerfinance.gov/compliance/compliance-resources/other-applicable-requirements/fair-credit-reporting-act/model-forms-and-disclosures/
15 U.S.C. § 1681m, Requirements on Users of Consumer Reports. Legal Information Institute, Cornell Law School. https://www.law.cornell.edu/uscode/text/15/1681m
15 U.S.C. § 1681n, Civil Liability for Willful Noncompliance. Legal Information Institute, Cornell Law School. https://www.law.cornell.edu/uscode/text/15/1681n
15 U.S.C. § 1681o, Civil Liability for Negligent Noncompliance. Legal Information Institute, Cornell Law School. https://www.law.cornell.edu/uscode/text/15/1681o
15 U.S.C. § 1681i, Procedure in Case of Disputed Accuracy. Legal Information Institute, Cornell Law School. https://www.law.cornell.edu/uscode/text/15/1681i
U.S. Equal Employment Opportunity Commission. (2012). Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions Under Title VII. https://www.eeoc.gov/laws/guidance/enforcement-guidance-consideration-arrest-and-conviction-records-employment-decisions
U.S. Department of Justice, Office of Public Affairs. (2026, June 9). Justice Department Concludes EEOC Disparate-Impact Guidelines Violate the Constitution. https://www.justice.gov/opa/pr/justice-department-concludes-eeoc-disparate-impact-guidelines-violate-constitution
Society for Human Resource Management. FCRA 101: How to Avoid Risky Background Checks. https://www.shrm.org/topics-tools/news/talent-acquisition/fcra-101-how-to-avoid-risky-background-checks
Society for Human Resource Management. FCRA Preliminary Notice of Adverse Action (form). https://www.shrm.org/topics-tools/tools/forms/fcra-preliminary-notice-adverse-action
Society for Human Resource Management. FCRA Final Notice of Adverse Action (form). https://www.shrm.org/topics-tools/tools/forms/fcra-final-notice-adverse-action
California Government Code § 12952 (Fair Chance Act). California Legislative Information. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=GOV§ionNum=12952
California Civil Rights Department. Fair Chance Act: Guide to Using CRD’s Sample Forms. https://calcivilrights.ca.gov/fair-chance-act/fca-forms/
New York City Commission on Human Rights. The Fair Chance Act. https://www.nyc.gov/site/cchr/law/fair-chance-act.page
City of Philadelphia, Fair Criminal Record Screening Standards Ordinance, as amended by Bill No. 250373-A (effective January 6, 2026). Summary via Littler Mendelson: https://www.littler.com/news-analysis/asap/philadelphia-passes-additional-amendments-fair-chance-ordinance
Washington State Fair Chance Act, as amended by HB 1747 (2025), codified at RCW 49.94 (effective July 1, 2026 for employers with 15 or more employees). Summary via K&L Gates: https://www.klgates.com/Sweeping-Amendments-Impose-New-Obligations-on-Employers-Conducting-Criminal-Background-Checks-in-Washington-Starting-1-July-2026-6-29-2026
Consumer Financial Services Law Monitor, Troutman Pepper Locke. (2026, January). Credit Reporting Litigation to Rise Further Given State Laws. https://www.consumerfinancialserviceslawmonitor.com/2026/01/credit-reporting-litigation-to-rise-further-given-state-laws/
GCheck. (2026). Trust in Hiring Report (n=1,500 U.S. workers). https://gcheck.com/whitepapers/trust-in-hiring-report/
ABOUT THE CREATOR
Charm Paz, CHRP
Recruiter & Editor
Charm Paz is an HR professional at GCheck, specializing in background screening, fair hiring, and regulatory compliance. She holds from the Professional Background Screening Association (PBSA) and helps organizations navigate employment regulations with clarity and confidence.
With a background in Industrial and Organizational Psychology, she translates policy into practice to build ethical, compliant, human-centered hiring systems that strengthen decision-making over time.
