Under the Fair Credit Reporting Act (FCRA), any time you plan to reject an applicant based even partly on a background report, you must run a two-step adverse-action process. Skipping either step is one of the most common, and most expensive, mistakes in screening, with statutory damages of $100 to $1,000 per violation before class-action exposure.
Step one is the pre-adverse action notice. Before you make a final decision, you must send the candidate a copy of the report you relied on and the CFPB's "A Summary of Your Rights Under the FCRA." This gives the applicant a chance to dispute inaccuracies or explain context, for example, a record that belongs to someone with a similar name, or a charge that was later dismissed.
Then you must wait a reasonable period before finalizing. Courts and the FTC have not fixed an exact number, but five business days has become the defensible industry standard. Waiting only a day or two invites a claim that you never gave the applicant a real opportunity to respond.
Step two is the adverse-action notice itself. Once the waiting period passes and you proceed, send a second notice stating the decision, the name and contact details of the consumer reporting agency (and a statement that the CRA did not make the decision), the applicant's right to a free report within 60 days, and their right to dispute the accuracy of the information.
Document every step with timestamps. In an audit or lawsuit, your ability to prove exactly when each notice went out, and that the report and summary of rights were included, is usually what separates a dismissed claim from a settlement.