Employers sometimes assume that following the FCRA is the whole compliance picture. It isn’t. The FCRA sets the federal baseline for background checks, but it’s a floor, not a ceiling, and state and local laws routinely layer additional requirements on top of it. Understanding how the two relate, and where they diverge, matters for any employer hiring across more than one location.
Important: State and local law can add protections beyond what the FCRA requires, but cannot reduce the protections the FCRA already guarantees. Compliance requires satisfying both layers simultaneously, not choosing whichever is less restrictive.
What the FCRA Actually Governs
The FCRA is a federal law that regulates how consumer reporting agencies, including background screening companies, collect, use, and share information. It establishes the baseline requirements around disclosure, authorization, accuracy procedures, dispute rights, and the adverse action process before a negative employment decision can be finalized. These requirements apply nationwide, regardless of which state an employer or applicant is in.
What State and Local Law Adds
State and local law generally doesn’t override the FCRA, it builds on top of it, often addressing areas the FCRA leaves untouched or only partially covers. Common categories of state-level additions include:
- Ban the Box and Fair Chance laws, restricting when criminal history can be asked about or considered
- Shorter reporting lookback periods for certain criminal or credit information
- Salary history bans, restricting what compensation information can be requested or relied on
- Additional disclosure requirements beyond the federal standard
- Restrictions or outright bans on employment credit checks for most positions
- Marijuana-related employment protections that limit how a positive test can be used in hiring decisions
None of these state provisions replace the FCRA’s requirements, an employer still has to satisfy federal disclosure, authorization, and adverse action obligations regardless of which state they’re in. State law simply narrows what’s permitted further, on top of that federal foundation.
What Happens When Federal and State Law Seem to Conflict
In practice, true conflicts are rare, because state law is generally only permitted to add restrictions, not remove federal protections. If a state law appears to allow something the FCRA prohibits, the FCRA still governs, since federal consumer protection law generally sets a floor that state law cannot legally undercut. The more common scenario isn’t conflict, it’s stacking: an employer needs to satisfy the FCRA’s requirements and whatever additional state or local requirement applies in that specific jurisdiction, both at once.
Example: Reporting Lookback Periods
The FCRA allows criminal convictions to be reported indefinitely in most cases, while certain non-conviction information is generally limited to seven years. Several states impose stricter limits than this federal baseline, capping how far back even conviction history can be reported for employment purposes. An employer operating in one of these states has to follow the shorter state limit, not the more permissive federal one, since the state requirement is more protective of the applicant, exactly the kind of addition the FCRA framework allows.
Example: Employment Credit Checks
The FCRA permits credit reports to be used for employment purposes when a permissible purpose exists and proper disclosure and authorization are obtained. A meaningful number of states go further, restricting or banning employment credit checks entirely except for a narrow set of roles, such as certain financial or fiduciary positions. An employer in one of these states cannot rely on FCRA permissibility alone, the state restriction adds a requirement the FCRA doesn’t impose on its own.
Example: Timing of Criminal History Questions
The FCRA doesn’t regulate when in the hiring process an employer can ask about criminal history, it governs the background check process itself once initiated. Ban the Box and Fair Chance laws fill that gap at the state and local level, restricting when criminal history questions can be asked and, in some jurisdictions, requiring an individualized assessment before a criminal record can be used to deny employment. These requirements exist entirely independent of the FCRA and can be violated even by an employer who is otherwise fully FCRA-compliant.
Why This Matters More for Multi-State Employers
An employer hiring in a single state only needs to track one layer of state and local requirements on top of the federal baseline. An employer hiring across multiple states, or in multiple cities within a state with additional local ordinances, has to track a meaningfully more complex compliance picture, since requirements can differ significantly not just state to state, but sometimes city to city within the same state. A single national screening policy built only around FCRA compliance is very unlikely to satisfy every jurisdiction an employer operates in.
A Practical Approach to Multi-Layer Compliance
- Start with FCRA compliance as the non-negotiable federal foundation, disclosure, authorization, accuracy, and adverse action
- Identify every state and locality where hiring actually occurs, not just where the company is headquartered
- Confirm specific state and local requirements for each of those jurisdictions individually
- Build screening policies and forms that satisfy the strictest applicable requirement where multiple jurisdictions overlap for a single applicant
- Revisit this regularly, since state and local requirements in this area change relatively often
Common Misunderstandings
“FCRA compliance means I’m fully compliant everywhere.” Not necessarily. State and local law frequently adds requirements the FCRA doesn’t address at all.
“State law can loosen federal requirements.” It can’t. State law can only add protections on top of the FCRA, not reduce what federal law already requires.
“If my state has no specific law, I don’t need to think about this.” Not always true. City and county-level ordinances frequently impose requirements beyond whatever exists at the state level.
The Bottom Line
The FCRA and state law aren’t competing systems, they’re layered ones. The FCRA sets a federal floor that applies everywhere, while state and local law frequently raises that floor further in specific ways: shorter lookback periods, credit check restrictions, Ban the Box timing, and more. Employers hiring across multiple jurisdictions need to treat compliance as a stack, not a single checklist, confirming what each layer requires rather than assuming federal compliance alone is enough.
