Here's the part people miss. In a state that restricts employment credit checks, the violation isn't what you do with the report. It's ordering it in the first place. If the role doesn't fall under one of that state's exceptions, pulling the credit report is the illegal act, full stop, even if you never look at it, even if the candidate would have failed on some other basis anyway.
Let me explain why that distinction matters, because a lot of employers get this backwards.
Most background check rules work like this: you can gather the information, you just can't misuse it. Criminal history is a good example. Federal law generally lets you ask, you just can't apply it in a way that has an unfair, unjustified impact on a protected group.
Credit check laws in restrictive states work differently. " That's a much harder line. There's no good intent that saves you here. There's no "we only used it as one factor among many" defense.
If the job doesn't qualify and you ran the check anyway, you're already on the wrong side of it.
So to say that a different way: this isn't a rule about how you use data. It's a rule about whether you're allowed to collect it at all. That's the whole point, and it's why so many employers trip over it without realizing.
I know that's not what you want to hear. You want a list of states, a clean table, done. I'm not going to hand you one, and here's why.
This area of law moves. States add restrictions, tweak exception categories, and change effective dates more often than most employers expect. A list that was accurate in January can be stale by summer.
If I print a fixed list here and one of those states amends its exception language six months from now, you'd be relying on something that's already wrong, and you wouldn't know it.
What I can tell you with confidence: this is not a rare, exotic rule anymore. A meaningful and growing number of states restrict or outright ban employment credit checks for most jobs. If you operate in more than one state, you need to check this state by state, not assume your home state's rule travels with you.
Before you run a credit check on anyone, check that specific state's current law. Not a blog post from two years ago. Not what your last employer did. The actual current statute, or a screening provider or employment attorney who tracks it for a living.
Even in restrictive states, exceptions exist. They tend to cluster around a few themes, though the exact wording varies a lot by state:
Notice what's missing from that list: most retail, food service, warehouse, administrative, and general office jobs. That's exactly where employers get in trouble. They run a credit check out of habit, because it's part of their standard hiring packet, without asking whether this specific role in this specific state actually qualifies.
That part's not optional. "We check credit on everyone" is a policy that will eventually cost you money in a restricted state.
Employers sometimes assume the risk only kicks in if the check comes back and gets used against the candidate. It doesn't work that way. Under most of these state laws, ordering the report from the consumer reporting agency is the act that triggers the violation.
The report doesn't have to influence the decision. It doesn't have to be read carefully, or at all.
This trips up HR teams using older application templates or automated background check packages that bundle credit checks in by default. If your intake form or your vendor's default package includes a credit pull for a role that doesn't need it, you've already made the mistake by the time anyone reviews a result.
Consequences vary by state, but they typically include a private right of action, meaning the candidate or employee can sue you directly, plus state agency enforcement in some places. This sits on top of your normal FCRA obligations, which are federal and apply regardless of what any individual state does.
Getting the state-law piece wrong doesn't excuse you from FCRA. It's an additional layer, not a substitute.
Before you order a credit report on any candidate, ask one question first: does this specific role, in this specific state, actually qualify for an exception under current law? Not "did it qualify last year." Not "does it feel like a finance-adjacent job." Confirm it, in writing, with someone who tracks current state statutes.
If you can't confirm the role qualifies, don't run the check. That's the whole rule. It's simple to state and easy to get wrong in practice, which is exactly why I keep coming back to it with clients who assumed their standard hiring packet was fine.