Before you turn someone down for a criminal record, the EEOC expects you to look at three things: how serious the offense was, how much time has passed since it happened, and how closely it connects to the actual job.
That's called an individualized assessment. Skipping it and rejecting anyone with any record, no matter what it is, is exactly the kind of blanket policy the EEOC has flagged for years as a discrimination risk.
The EEOC enforces Title VII, the federal law against employment discrimination. Criminal record policies aren't automatically illegal under it. But the EEOC's own guidance points out that arrest and conviction rates aren't spread evenly across race and national origin in this country.
A blanket "no felons" policy, even one nobody meant as discriminatory, can end up screening out one group at a much higher rate than another.
That's called disparate impact. Nobody has to prove you meant to discriminate, only that the policy landed harder on one group. Individualized assessment is the EEOC's answer to that problem. It forces you to look at the person, not just the record.
That part's not optional if you want your process to hold up.
The EEOC guidance points to three things, sometimes called the Green factors after the court case that first laid them out. You don't need to know the case name. You need to know what to actually do.
So to say that again a different way: you're not asking "did this person do something bad once." You're asking whether that specific thing, that long ago, actually tells you anything real about whether they can do this specific job safely and honestly.
Yes, and this is the step I see skipped the most. Before you finalize a rejection, EEOC guidance expects you to give the applicant a real chance to explain the circumstances, or point to evidence of rehabilitation, before the decision is locked in.
In practice, you send the notice required under the Fair Credit Reporting Act (the federal law governing background check reports) along with a copy of the report. The applicant gets a real window, usually a few business days, to respond before you move forward.
Maybe the conviction was expunged and didn't show up correctly. Maybe there's context that changes how serious it looks. You don't know until you ask.
I've watched employers treat this step as a formality, a box to check on the way to a decision they'd already made. That's backwards. The decision isn't final until this step happens.
The EEOC's guidance is federal, so the reasoning behind it applies to any employer covered by Title VII, which generally means 15 or more employees. But guidance is not the same thing as a hard, standalone law with its own penalty. It's the EEOC explaining how it interprets Title VII when a criminal record policy gets challenged.
A handful of states and cities have gone further and written individualized assessment directly into their own laws, with specific documentation requirements attached. Los Angeles is one example. I covered that city's version, which requires its own written assessment on top of whatever state and federal steps you're already doing, in a separate article.
If you operate there, read that one too. This piece is the general version that applies no matter where you're hiring.
Not having a local law naming this doesn't mean you're off the hook. The federal discrimination risk is still there either way.
Here's the part most small HR teams get wrong. It's not enough to think it through in your head and decide the person's fine, or not fine. You need something written down.
| Step | What it means in practice |
|---|---|
| Review the record | Note what the offense actually was, not just "has a record" |
| Weigh the three factors | Write down your reasoning on severity, time passed, and job relevance |
| Notify the applicant | Send the FCRA pre-adverse action notice and a copy of the report |
| Give a real window to respond | Hold the decision open, don't just wait out the clock |
| Finalize | Document the final call, whatever it is |
A short template, even three or four lines per candidate, is enough. What you're building is a record that shows you actually thought about this person specifically, instead of applying a blanket rule. If your process ever gets questioned, that paper trail is the entire difference between "we made a careful decision" and "we don't actually know why we did this."
Nothing happens immediately, and that's exactly why this step gets skipped so often. A blanket policy feels faster day to day. The risk shows up later, when a rejected applicant challenges the decision and your only answer is "the policy says no felons." That's the exact policy shape the EEOC's guidance was written to catch.
I'm not a lawyer, and this guidance gets revisited over time, so have an employment attorney check the actual wording before you build a policy from scratch. But the underlying logic, the person and the job, not just the record, isn't going out of style anytime soon.
No, and I'll say that plainly because people assume it. Individualized assessment is only one piece of a compliant process. You still owe every applicant the FCRA disclosure and authorization steps before you even pull a report, and the full pre-adverse and adverse action notice sequence if you decide not to hire them for any reason the report turned up.
Getting the assessment right doesn't excuse getting the paperwork wrong, and the other way around.
Treat them as two separate checklists that both need to be right, not one box you can check and move on from.