You can't write one background check policy that works in all fifty states. Not a compliant one, anyway. Build it around the federal floor and you'll break state law the first time you hire in California, Illinois, Colorado, or New York City. Build it around the strictest state and you'll tie your own hands everywhere else.
That's the trap. Employers keep looking for a single set of rules they can hand to every hiring manager and never think about again. It doesn't exist. Here's why, and what to build instead.
The Fair Credit Reporting Act sets a federal floor for background checks. Every state has to meet it. What a lot of employers miss is that many states then build their own, stricter rules on top of that floor, and those state rules don't always agree with each other either.
Three things vary the most: when you're allowed to ask about criminal history, how far back a report can look, and whether you can run a credit check at all. Get any one of those wrong in the wrong state, and you've got a compliance problem, not a typo.
So to say that again a different way: this isn't one rulebook with a few footnotes. It's dozens of rulebooks that overlap in some places and flatly contradict each other in others.
Say your policy runs on the federal floor plus whatever's easiest to apply company-wide. That policy will under-comply the moment a candidate sits in the wrong state.
California runs its own timing rule under the Fair Chance Act, on top of a separate law about how far back a report can go. We cover both in our guide to California's timing rule and the 7-year lookback rule.
New York City runs its own version, with its own required order for when the conditional offer, the background check, and the final decision each have to happen. Our NYC Fair Chance Act guide walks through that sequence.
Illinois asks employers to run something close to a documented legal test, weighing whether a conviction actually relates to the job, before turning someone down. We call it the substantial relationship test. It's not optional paperwork. It's a real analysis you have to write down.
Colorado layers a statewide ban-the-box law, the Job Application Fairness Act, on top of its own reporting rules. We've documented what it restricts, and it now covers nearly every private employer in the state, not just the big ones.
A policy built only to the federal floor never sees any of this coming. It looks compliant on paper, right up until you actually hire someone in one of these states.
Flip it around and the opposite mistake shows up just as often. An employer gets burned once in California, panics, and applies California's strictest rule to every state they hire in. Sounds safe. It isn't free.
Delay every criminal history question until after a conditional offer, nationwide, and you're doing that in states where the law never required it. Some employers want that information earlier, to route an application faster or avoid a wasted interview. Applying California's timing everywhere gives that up for no legal reason at all.
Credit checks are the clearest example. Plenty of states place real restrictions on when you can run one, and we've mapped out where those restrictions apply. But plenty of other states don't restrict it at all. Ban credit checks company-wide because a handful of states require it, and you've given up a legitimate hiring signal in Texas or Florida to solve a problem you don't actually have there.
Over-restricting isn't a compliance win. It's a cost you're paying for a problem that doesn't exist in most of your states.
Take a mid-size logistics company, forty employees, hiring in Texas, California, Illinois, and New York City. They wrote one policy off the federal FCRA minimum, because that's what came in their onboarding template. Four things break almost immediately.
None of those four mistakes needed bad intentions. Each one came from applying a rule built for one place to a place with a different rule. That's the actual failure mode. Not sloppiness. Structure.
We've written detailed guides on individual states because the differences are real, not because we needed the content. Read a handful side by side and the pattern's obvious. No two states solve this the same way.
| State or city | What makes it different | Where we cover it |
|---|---|---|
| California | Its own timing rule under the Fair Chance Act, plus a 7-year reporting cap with no salary exception | Timing rule |
| Colorado | Statewide ban-the-box law, and the same 7-year cap as California on a different statute | Colorado vs. California |
| Illinois | Requires a documented "substantial relationship" analysis before denying someone | Substantial relationship test |
| New York City | A specific required order for the offer, the check, and the decision | Fair Chance Act order |
| Massachusetts | Its own CORI law governing how criminal record information can be used | CORI law rules |
| Hawaii | A split lookback, with different windows for different record types | 7-year and 5-year rule |
| Los Angeles | Requires its own documented individualized assessment on top of state law | Individualized assessment |
That's seven separate answers to what looks like one question. Multiply that across fifty states, plus the cities and counties layering on their own rules, and "one national policy" stops being a simplification. It's a guess.
Here's what I'd build instead, and what I tell clients who ask me this. Split the policy into two layers. One baseline that applies everywhere. A set of state overlays on top of it, triggered by where the candidate actually works.
The baseline handles everything federal law already makes uniform: the standalone disclosure, the signed authorization, the two-step adverse action process, and your record retention rules. None of that changes state to state. We've published a template for that baseline layer if you're starting from scratch.
The overlay layer handles the parts that do change: when you're allowed to ask about criminal history, how far back a report can go, whether a credit check is on the table, and any extra documentation a state requires, like Illinois's substantial relationship analysis or LA's individualized assessment.
Don't build one policy and hope it holds up everywhere. Build one foundation, then add exactly what each state actually requires on top of it. Nothing more, nothing less.
Start with where your candidates actually work, not where your company is headquartered. A remote hire living in Colorado is a Colorado hire for compliance purposes, even if your office sits in Texas. That trips up remote-first companies more than almost anything else.
List every state where you currently have candidates or employees. For each one, write down five things: when you're allowed to ask about criminal history, how far back a report can look, whether credit checks are restricted, which records get automatically excluded under that state's clean slate or sealing law, and whether the disclosure form needs any extra state-specific language. That's your overlay, state by state.
Five items sounds like a lot the first time you do it. It isn't. Most states will answer "no different from the baseline" on two or three of them. You're only really building something new for the states that actually diverge, which is usually a shorter list than people expect.
You don't need a fifty-state matrix on day one. Most companies hire concentrated in a handful of states. Build overlays for those first, then add a new one whenever you open a role in a state you haven't hired in before.
Name one person who owns this, the same way you'd name one owner for the baseline policy. When a state law changes, and it will, that's the person who catches it before it becomes a problem.
State legislatures don't pause. New ban-the-box laws, new lookback caps, and new credit-check restrictions show up most years, sometimes in states that had none of this the year before.
Set a real review date, at least once a year, and check it against your current hiring footprint. Started hiring in a new state since your last review? That state needs its own overlay before your next candidate there, not after.
That part's not optional. A policy that was accurate two years ago and never got checked again isn't a policy anymore. It's a document that used to be true.
Can't I just apply the strictest state's rules everywhere and call it done? You can, and some employers do. It's simpler to manage, but you give up real flexibility in every state that doesn't require it, and it still doesn't fix the states with a requirement the strictest state doesn't even have, like Illinois's documentation rule.
Does this apply if I only have a handful of remote employees? Yes, maybe even more than if you ran one big office. A five-person remote team spread across four states has four states' worth of rules to track, without the HR staff a bigger company would have to catch a mistake.
How many states actually need their own overlay? Fewer than you'd think, if you're honest about where your candidates actually live. Start with the states you're hiring in right now. Add the rest as you grow into them, not all at once.
I'm not a lawyer, and I'm not your lawyer. Every state law named above changes over time, sometimes with almost no notice. Treat this as the structure to build, and get each state's specific rule confirmed by counsel, or a screening provider who tracks it closely, before you lock any of it into a real policy.