Maybe. Whether you're allowed to run a credit check on this candidate depends on two different things stacking on top of each other, not one. Federal law sets the paperwork every credit check needs. A separate layer of state law decides whether you can run one on this job at all.
I already mapped which states restrict this and why in an earlier piece, so I won't repeat that list here. This one is about something narrower: what "permissible purpose" actually means, and why the disclosure and consent paperwork for a credit check ends up stricter than what you'd send for a standard criminal or employment check.
One habit worth keeping from that earlier piece. Verify your own state's current rule before you rely on anything below. This corner of the law moves fast.
The Fair Credit Reporting Act treats an employment credit check the same way it treats any other background check pulled through a third-party company, called a consumer reporting agency. Three things have to happen, in order, every single time.
You give the candidate a standalone written disclosure. Not buried in an offer letter or an application packet, its own document, saying plainly that you're going to pull a consumer report. Then you get their signed authorization.
Only after both of those do you have a permissible purpose to actually request the report. Skip either step and it doesn't matter how legal the check is in your state. You've broken federal law before the report even shows up.
This phrase gets thrown around like it's obvious. It isn't. Permissible purpose is the FCRA's way of saying you need an actual business reason tied to the job, not just curiosity about how someone manages money.
For employment, the law calls this "employment purposes," a defined term covering hiring, promotion, reassignment, and retention. Signed authorization is what turns that general category into a real, specific purpose for this candidate, for this job.
So to say that again a different way: authorization isn't just a formality you collect and file. It's the thing that makes your purpose legally permissible in the first place. No signature, no purpose, no report.
Here's where credit checks get pickier than the rest of your screening package. A permissible purpose for a criminal search is broad. Almost any job clears that bar. A permissible purpose for a credit check gets tested harder, especially in a state that only allows the check for specific roles.
You need to be able to say, in plain terms, why this job actually needs someone's financial history. "It's on our standard package" isn't an answer a regulator, or a candidate's lawyer, will accept.
Here's the part that matters once you already know your state allows the check. In a growing number of states that do allow it, the exemption comes with conditions attached, not just federal-level FCRA consent.
Some states require the disclosure to name the specific reason the role qualifies, tied to one of that state's listed exemptions. Cash handling. Signing authority over company funds. A federal FCRA disclosure alone doesn't cover that added step.
That's the real difference between a credit check and, say, a criminal background check. A criminal check usually only has the FCRA layer to satisfy. A credit check can carry a second, state-specific layer of disclosure right on top of it, and that layer changes depending on where the candidate will actually work.
That part's not optional. Get the state layer wrong and it doesn't matter how clean your FCRA paperwork is.
| Requirement | FCRA (federal, every check) | State credit-check law (where it applies) |
|---|---|---|
| Disclosure | Standalone written notice, before you pull anything | Often has to name the exemption the role qualifies under |
| Authorization | Signed consent from the candidate | Usually the same signature, sometimes a separate credit-specific line |
| Who it applies to | Every employment background check | Only credit checks, only in states that restrict them |
| What happens if skipped | FCRA violation, candidate can sue | Can void the exemption entirely, turning a legal check into an illegal one |
Read that bottom row twice. In a restricting state, getting the state paperwork wrong doesn't just add risk on top of what you already had. It can turn a check that was legal on paper into one that wasn't, after the fact.
If anything in the credit report pushes you toward turning the candidate down, the FCRA's adverse action steps kick in exactly the way they would for any other report. Pre-adverse notice, a copy of the report, a summary of rights, a wait, then a final notice if you're still saying no.
I've written elsewhere about the difference between that FCRA process and a fair, individualized decision under EEOC and Title VII rules, in more detail here. The short version for a credit check specifically: don't reject someone over a low score without being able to explain, plainly, how it connects to this job. That's the check most likely to get challenged as unrelated to the work.
A candidate can refuse to authorize a credit check. That's their right under FCRA, since authorization has to be voluntary to count as authorization at all.
What you can't do is guarantee nothing happens as a result. If the role has a genuine business reason for the check, cash handling, financial signing authority, you can treat a refusal the way you'd treat a candidate declining any other required piece of the screening process.
Just be consistent about it. Apply that rule the same way to every candidate for that role. Not selectively, and not based on a gut feeling about who probably has bad credit.
Do I need separate authorization for a credit check, or does my standard background check authorization cover it? Check your own form. A lot of standard FCRA authorization language is broad enough to cover a credit check, but some states require it called out by name. Don't assume. Read your own paperwork.
Can I run a credit check on every candidate, just to be consistent? Only where it's legal, and only where you've got a real permissible purpose tied to the job. "Consistency" doesn't create a permissible purpose on its own. Running this on a receptionist role with no financial access is exactly the kind of pull that draws scrutiny.
What if I'm hiring across multiple states? Then you're checking the rule state by state, for wherever the candidate will actually work, not wherever your company is headquartered. That's the piece employers miss most often.
One last thing worth saying plainly. Legal and wise aren't the same question. Even where a credit check is fully allowed, ask yourself honestly whether it tells you anything real about this particular job before you add it to the package.